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PREFACE 



This reference guide describes a- ^dustrial communications and distributed 
control system — the Modbus Communications system. This system integrates 
PC's, computers, terminals, and otne r monitoring, sensing, and control devices 

Modbus systems have been instated for energy management, transfer line 
control, ana pipeline monitoring. Tne system's reliability and flexibility allow it to 
nana;e a*; kmcs o' orccesses anc oc-erations in <ust aDOut any maustry Like our 
PC's, it's ruggea enough for an incusf'al environment. Since this communications 
svstem is soecifical'y designed for 3 C's. it's as flexible in its applications as they 
are. Tne Modbus Communications svstem is Gould's commitment to provide 
industrial communications toois tor :-ie future. 



Related Documents: 



Modbus 184/384 Programming Protocol PI-MBUS-301 
Modbus 484 Programming Protocc PI-MBUS-302 
Modbus 554 Programming Protocc PI-MBUS-303 
Modbus System Planning ML-M BUS-PLN 

The information in this document s subject to change without notice and should 
not be construed as a commitment b> Gould Inc., Programmable Control Division. 
Gould Inc., assumes no responsibly for any errors that may appear in this 
document. No part of this document may be reproduced in any form without the 
express written permission of Gould Inc., Programmable Control Division. All 
rights reserved. 



The following ar= trademarks of Gould Inc.: 

184 584L 

Micro 84 384 884 

Modbus 484 P180 

Modvue 584 P190 

Modway 584M 



I Copyr z~: 1985, Gould inc. 
?' -:ed in U.S.A. 



GOULD INC.. PROGRAMMABLE CONTROL DIVISION 
CONFIDENTIALITY AGREEMENT 



Gould Inc.. Programmable Control Division (hereinafter refe r 'ed to as "Gould"; and 
tne user's of tms aocument thereinafter referreo :c as " T re Company"; desire tc 
share proprietary tecnmcai information concerning Gouic 5 Modous communi- 
zat'Ons system. 

= c this reasm Gouic is disclosing to The Company mfcr'-atcn tn the form of a 
Mocdus Protocol Reference Guide. In as mucn as 3:jid considers this 
in'ormation tc De proprietary and desires tnat it De maintained .n confidence, it is 
nereoy ag f eec oy The Company that sucn aata snail be ma.'vainea m confidence 
by The Company for a period of ten years following the date of this agreement. 

During this period. Tne Company shall not divulge such ;r. ; cmation to any third 
party without the prior written consent of Gould and shall ta«e reasonable efforts 
to prevent a~y unauthorized disclosure by its employees, hc.vever. The Company 
sr.al! net be cbiiga'ed tc keep such information in conf'SfCt if it was in The 
Company s possession prior to its receipt from Gould, if s or becomes public 
k-pwiedce .Mthout the fault of The Company, or the "crmation becomes 
available or an unrestricted basis from a :hird party having = egal right to disclose 
such information. 

The Company's receipt of the Modbus Protocol Reference Guide constitutes 
acceptance of these terms. 
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SECTION 1 
MODBUS PROTOCOL 



A data communications system protocol controls the ianguage structure f 
message format common to aii cevices on a network. The protocol is vital to tre 
system s operation; it determines now the master and siaves establish and ores' 
of' contact, now the senoer and receiver are identified, hew messages a-e 
exenanged in an ordeny manner, and now errors are detected. Tne protoc: 
controls the query and resccr.se cycie *vhich takes place between master a~c 
slave devices, as shown in Figure 1*1. 



MASTER 



SLAVE 



SLAVE ADDRESS 



FUNCTION CODE 



DATA 



ERROR CHECK 



SLAVE ADDRESS 



FUNCTION CODE 



DATA 



ERROR CHECK 



Figure 7-7. Master and Slave Query/Response Cycle 



The protocol provides for one master and up to 247 PC slaves on a common lire. 
Although the protocol supports jD to 247 slaves, certain device restrictions ma> 
limit the number of slaves to a number less than 247. For example. Gould's J4~= 
modem restricts the total numoer of slaves on the line to 32. Each siave s 
assigned a fixed unique device address-in the range of 1 to 247. 

Only the master initiates a transaction. Transactions are either a query/response 
type (only a single slave is addressed) or a broadcast/no response type (all siaves 
are addressed). A transaction comprises a single query and single response frame 
or a single broadcast frame. 

Certain characteristics of the Modbus protocol are fixed, such as the frame format, 
frame sequences, handling of communications errors and exception conditions, 
and the functions performed. 

Other characteristics are user selectable. These include a choice of transmission 
medium, baud rate, character parity, number of stop bits, and transmission modes 
(ASCII or RTU). The user selectee parameters are set (hardwired or programmed 
at each station. These parameters cannot be changed while the system is running. 

In order for hardware to send messages over data lines, the message must be 
contained in an envelope. The envelope leaves the hardware through a "port" and 
is "carried" over the line to the addressed device. In this case, the Modbus 
protocol provides the envelope in the form of message frames. The information n 
the message is the address of tre intended receiver, what the receiver is to it. 
data needed to perform an action, and a means of checking for errors. 
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When the message reaches :ne Modbus Slave Interface, it enters that addressed 
device through a similar "90-.". Tne addressed device removes the envelope, reaos 
the message, anc. if no e r 'cs nave occurred, performs tne reauested ?as* i! tnen 
replaces the message > r :z tne saved enveloce and " returns to sencs*'. The 
information in the response message is the slave adaress. the action De ri ormec. 
data acquired as a result 3* tne action, ana a means of cnecking for erors. No 
resDonse is transmitted If irse message is a "broadcast", (a message tc a,. s;avesi 
as indicated cy an adcess of C. 

The receiving device "writes"' and sends a response o? its own if an erroneous 
message is received. The f actions that a Modbus siave interface can percrm are 
defined m Tables Bl. £2. ana B3 for the L'384. 4S4 ana 584 respective:,. (See 
Appendix B). Also see Tac.fi 3-1. 

in most cases, the master can send another message to any slave as soon as it 
receives a va : j response, c after a user-selected time interval if no response is 
received. Ail messages ma. oe sent as queries, generating slave responses Only 
messages *nicn ao not r.eec a 'esponse in order to fulfill their functio- —ay be 
sent as broaacast messages. These messages are Modify Coil Status Modify 
Register Content, Force '.'ultiple Coils, Preset Multiple Registers, anc rertain 
subfunctions of Loopback Diagnostic Test and Program. 

1.1 MODES OF TRANSMISSION 

The mode of transmission is the structure of the individual units of information 
within a message, and the numbering system used to transmit the data. Two 
modes of transmission are available for use in a Modbus system. Both modes 
provide the same capabi! ; ties for communicating with PC slaves: the mode is 
selected depending on the equipment used as a Modbus master. One moce must 
be used per Modbus system: mixing of modes is not allowed. The modes a-e ASCII 
(American Standard Code 'cr Information Interchange), and RTU (Remote T erminal 
Unit). The modes are defi-ed in Table 1-1. 

Table 7-7. Characteristics of ASCII and RTU Modes of Transmiss.c- 










Characteristic 


ASCII (7-bit) 


RTU (8-bit) 


Ceding System 


nexaaecimal (uses 
ASCII printable 
characters: 0-9.A-F) 


8-Dit 

binary 


Number of bits per 

character: 
start bits 
data bits (least 
significant first) 
parity (optional) 

stop bits 


1 
7 

1 (1-bit sent 
for even or odd 
parity, no bits 
for no parity) 

1 or 2 


1 
8 

1 (1-bit sent 
for even or Dda 
parity, no bits 
for no parity 

1 or 2 


Error checking 


LRC (Longitudinal) 
Redundancy Check) 
See paragraph 1.2.2 


CRC (Cyclical 
Redundancy Checki 
See paragrapn ' Z.' 
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ASCII printable characters are easy to view wnen troubleshooting and this mode 
is suited to computer masters programmed sh a high level language, sucn as 
PORTRAN. as well as PC masters. RTU is suites to comDuter masters programmed 
it\ a machine language, as well as PC masters. 

in tn« RT'j mode, data is sent in 8-bit binary characters. In the ASCII moae. eacn 
RTU cnaracter is first divided into two 4-bit parts (hign order anc icw oraer> ana 
then reoresentea by their hexadecimal ecuivalent. The iSCli characters 
representing tne hexidecimal characters are used to construe; the message. The 
ASCII mode uses twice as many cnaracters as the RTU moae. but decoding and 
handling the ASCII data is easier. Additionally, in the RTU moce. message 
characters must be transmitted in a continuous stream. In the ASCII mode, breaks 
of up to 1 second can occur between characters to allow for a relatively slower 
master. 

V2 ERROR DE~=:~!CN 

There are two types of errors which may cccur in a communica'Jcr.s system: 
transmission errors and programming or oce-ation errors. The Modbus system has 
specific methods for dealing with either type of error. 

Communications errors usually consist of a changed bit or bits within a message. 
For example, 0001 0100 may become 0001 0110, changing the decimal value from 
20 to 22. It is much less common to have a bit added to or deleted from a message. 
The most frequent cause of communications errors is noise: unwanted electrical 
signals in a communications channel. These signals occur because of electrcal 
interference from machinery, damage to the communications charnel, impu se 
noise (spikes), etc. Communications errors are detected by character framing, a 
parity check, and a redundancy check. 

When the character framing, parity, cr redundancy checks detect a 
communications error, processing of the message stops. A PC slave will not act 
on or respond to the message. (The same 'esult occurs if a non-existent slave 
address is used.) 

When a communication error occurs, the message is unreliable. The PC slave 
cannot Know for sure if this message was ntended for it. So the CPU might be 
answering a message which was not its message to begin with. It is essential to 
program the Modbus master to assume a "mmunications er^or has occurred if 
there is no response in a reasonable time. T~e length of this time period depends 
upon baud rate, type of message, and scan time of the PC slave. Once :his time 
is determined, the master may be programmed to automatically retransmit the 
message. 

Both modes of transmission, RTU and ASCI!, include an optional parity bit in their 
character format. In RTU mode, it is the ninth bit of the data field (8 bits cf data 
and the parity bit). In ASCII mode it is the eighth bit of the data field (7 bits of data 
and the parity bit). If parity is not used, the parity bit is not transmitted. Parity is 
optional for the Modbus system; the interface units are configured for no parity, 
even parity, or odd parity at the time of installation. All units on a system must oe 
configured for the same option. 
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Parity helps detect single bit communications errors. The Modbus system 
determines whether the parity bit should be a 1 or in the 'olio-wing manner: 

• add the number of 1's in the data 

• determine if the number is even or odd 
For even parity: 

• if the number is ever., add a C as the parity bit to keep the numcer of i s even 

• if the number is odd, add a 1 as the parity bit to make the number of I s even 

• for example, in even parity the data 01 10 1000 would have a 1 as the parity bit. 
while the data 0110 1010 would have a zero as the parity bit 

Fo r odd parity: 

• the master adds a 1 or zero as tre parity bit so that the number of 1 s in the 
data is odd 

If there are two errors within a message, however, parity may not be able to detect 
the changes. If 0010 0000 is distorted to 0010 0011, the number of 1's in the data 
is still odd. 

The Modbus system provides several levels of error checking in order to assure the 
quality of the data transmission. To detect multibit errors where the parity has not 
changed, the system uses redundancy checks: Cyclical Redundancy Check (CRC) 
and Longitudinal Redundancy Check (LRC). Which redundancy check is used is 
dependent upon the mode of transmission. RTU uses the cyclical check and ASCII 
uses the longitudinal check. The generation of CRC and LRC is explained below. 
The CRC and LRC error checks are performed automatically. Paragraphs 1.2.1 and 
1.2.2 are included for your information only. 

1.2.1 CPC-16 (Cyclic Redundancy Check) Error Check Sequence 

The CRC-16 error check sequence is implemented as described in the following 
paragraphs. 

The message (data bits only, disregarding start/stop and optional parity bits) is 
.considered as one continuous binary number whose most significant bit (MSB) is 
transmitted first. The message is pre-multiplied by x" (shifted left 16 bits), then 
dividec by x' 6 - x" x : + 1 expressed as a binary number (11000000000000101 ). 
The integer quotient digits are ignored and the 6-bit remainder (initialized to ali 
ones at the start to avoid the case of all zeros being an accepted message) is 
appended to the message (MSB first) as the two CRC check bytes. The resulting 
message including CRC, when divided by the same polynomial (x" + x" + x J 1) 
at the receiver will give a zero remainder if no errors have occurred. (The receiving 
unit recalculates the CRC and compares it to the transmitted CRC). All arithmetic 
is performed modulo two (no carries). An example of the CRC-16 error check for 
message HEX 0207 (address 2, function 7 or a status request to slave number 2) 
is given in Figure 1-2. 
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The dev.ce used to serialize the data for transmission wr send the conventional 
LSB or ngni-most ba o* each character first, in generating the CBC. tne first or. 
transmutes >s oe f ined as tne MSB of the dmdenc Fbf cc-.emence then, anc since 
there are ~o carries used in arithmetic, let's assume white computing the CRC that 
the MSB :$ on the right. To be consistent, tne bit ccer of the generating 
DOiv^cm a must be reversec. The MSB of tne DCiync-'.a! is aropped since it 
affects cny tne Quotient anc not the remainder. This ye ds ICC 0000 0000 OOC" 
:hex ADC" Note that this reversal of the bit oraer will have no affect whatever or 
the m:e r cretation or bit oraer of characters externa' tc tne CRC calculations. 

The step by stec procedure to form the CRC-16 check bytes is as follows: 

1. Lcac a 16-bit register with all Vs. 

2. Ex; „sive OR the first 3-bit byte with the hign order byte of the 16-bit register. 
c:t ">g the result in the 16-bit register. 

3. S" ". the ".6-bit register one bit to the ngnt. 

4a. if t~e bit shifted out to the right (flag) is one, exclusive OR the generating 
polynomial 1010 000 000 0001 with the 16-bit register. 

4b. If the bit shifted out to the right is a zero; return tc step 3. 

5. Repeat steps 3 and 4 until 8 shifts have been performed. 

6. Exclusive OR the next 8-bit byte with the 16-bit register. 

7. Repeat step 3 through 6 until all bytes of the message have been exclusive 
CF. .vith the 16-bit register and shifted 8 times. 



8. The contents of the 16-bit register are tne 2 byte CRC error check and is acded 
to the message most significant bits first. 







16-BIT REGISTER 


MSB 


FLAG 


(Exclusive or) 


1111 


1111 


1111 


1111 











0000 


0010 






1111 


1111 


1111 


1101 




Shift 1 


0111 


1111 


1111 


1110 


1 


Polynomial 


1010 


0000 


0000 


0001 






1101 


1111 


1111 


1111 




Shift 2 


0110 


1111 


1111 


1111 


1 


Pclync-".iai 


0101 


0000 


0000 


0001 






1100 


1111 


1111 


1110 




Shift 3 


0110 


0111 


1111 


1111 





Shift 4 


0011 


0011 


1111 


1111 


1 


Polynomial 


1010 


0000 


0000 


0001 





Figure '-2. Example — CRC-16 Generation — Read Exception Status of Save 02 
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16-BIT REGISTER MSB FLAG 





1001 


0011 


1111 


1110 




Shift 5 


0100 


1001 


tm 


1111 


o 


Shift 6 


0010 


0100 


-111 


1111 


4 


Pnivnnmial 


1010 


0000 


oooo 


0001 






1000 


0100 


1111 


1110 




Shift 7 


0100 


0010 


0111 


1111 





Shift 8 


0010 


0001 


0011 


1111 


1 


Polynomial 


1010 


0000 


0000 


0001 






1000 


0001 


0011 


1110 




07 






0000 


0111 






1000 


0001 


0011 


1001 




Shift 1 


0100 


0000 


1001 


1100 


1 


Pnivnnmial 

r \jiy ( iui nidi 


1010 


0000 


0000 


0001 






1110 


0000 


1001 


1101 




Shift 2 


0111 


0000 


0100 


1110 


1 


Polynomial 


1010 


0000 


0000 


0001 






1101 


0000 


0010 


1111 




Shift 3 


0110 


1000 


0010 


0111 


1 


Polynomial 


1010 


0000 


0000 


0001 






1100 


1000 


0010 


0110 




Shift 4 


0110 


0100 


0001 


0011 





Shift 5 


0011 


0010 


0000 


1001 


1 


Polynomial 


1010 


0000 


0000 


0001 






1001 


0010 


0000 


1000 




Shift 6 


0100 


1001 


0000 


0100 





Shift 7 


0010 


0100 


1000 


0010 





Shift 8 


0001 


0010 


0100 


0001 






HEX 12 HEX 41 

TRANSMITTED MESSAGE WITH CRC-16 
(MESSAGE SHIFTED TO RIGHT TO TRANSMIT) 

12 41 07 02 

0001 0010 0100 0001 0000 0111 0000 0010 

Last bit TRANSMISSION ORDER First Bit 

Transmitted Transmitted 



Figure 1-2. Example — CRC-16 Generation — Read Exception Status of Slave 02 

(cont) 
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2 LRC (Longitudinal Redundancy Check) Error Check Sequence 

The error check secuence for the ASCII mode is LRC. The errcr c^eck is an 8-bit 
binary number rec r esented and transmittec as two ASCI! -.ex.cecimai (hex) 
cnaracters. The error check is produced oy converting tne nex characters tc binary, 
adding the binary characters without wraparound carry, and twc s complementing 
the resui:. See -igure 1-3.) At the receivec enc the LRC is recaicutatec and 
compared \o tne se~* LRC. The colon. CR. LF. anc any imceccec non-ASCII hex 
cnaracters are ignored in calculating the LRC. 



Address 





2 






0010 


Function 





1 




JOOO 


00C1 


Start Add H 0. 










JQUU 


0000 


Start Add L.O. 










□000 


0000 


Quantity of Pts 










noon 


nnnn 







8 




- xoo 


1000 










:ooc 


1011 








1's Complement 


--11 


010C 








♦ 1 




1 








2's Complement 


-.in 


0101 


Error Check 


F 


5 




F ' 


5 


Receiving PC sums up all 






0000 


0010 


data bytes receivec including 




0000 


0001 


the LRC at the end. 


The - 






"•000 


0000 


8-bit should all ecual zero. 






3000 


0000 


(Note, the sum may exceed 






:ooo 


0000 


8 bits — only the ic 


w order 




OK 5 


■xoo 


1000 


of bits should be saved.) 




Error Check 


-111 


0101 








SUM 


DO00 


0000 















Figure 7-3. EXAMPLE — LRC Generation — Read First 8 Cons -'om Slave 02 



MODBUS PROTOCOL 

As shown in the p r otocol overview, protocol covers the rules ?c communication 
between a masie' and slaves. With a PC master, the Mooes protocol is 
incorporated into tne PC interface, and all communication is transparent. (The 
Modbus Communications Handler is a FORTRAN-based software oroduct which 
programs a computer master to handle the Modbus system protocol. In this rase, 
communications tc a PC slave on a Modbus system are trarsrarent tc user- 
developed applications programs). The Modbus protocol is tailorec to the '.<ze of 
communications that an industrial user needs for a network of PC's, in gere'a the 
interpretation of fields within a message are identical between RTU anc ASCII 
transmission modes. (See Figures 1-4, and 1-5.) The major differences are 'vpe 
of error check performed on the message and that approximate:) twice -any 
characters are used in ASCII. Instead of sending a single 8-bit bina-y cha- 3 :ne 
equivalent pair o' 7-bit ASCII (0-9.A-0F) characters are sent. 
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1.3.1 ASCII Framing 

Framing in ASCII transmission mode is accomplished bv :~e use of the unique 
coionu character to indicate beginning of frame and car;ace return i'CRi urs 'eed 
(LFi to aenneate enc of frame. The line feec charac:e r aisc serves as a 
syncnromzing cnaracter which indicates that the transmit:. ng station is ready to 
receive ar immediate reply See Figure 1-4. 



BEG OF 
FRAME 


ADDRESS 


FUNCTION 


DATA 


ERROR 
CHECK 


EOF 


READY 
TO REC 
RE5P 




2-CHAR 
18-8 ITS 


2-CHAR 
-5- BITS 


N X 4-CHAR 
N X 16-BITS 


2-CHAR 
16-BITS 


CR 





C-AR = CHARACTER: 1 CHARACTER = 7 DATA BITS. 1 START SiT. 1 C= I 
STOF BITS AND OPTICNALL ■' - 1 PARITY BIT 



F>gure 1-4. ASCII Message Frame Format 



1.3.2 Remote Terminal Unit iRTU) Framing 

Frame synchronization can be maintained in RTU transmission mode only by 
simulating a synchronous message. The receiving device monitors the elapsed 
time between receipt of characters. If three and one-half cnaracter times elapse 
without a rew character or completion of the frame, then :he device flushes the 
frame and assumes that the next byte received will be an address. See Figure 1-5. 



Tl T2 T3 


ADDRESS 


FUNCTION 


DATA 


CHECK 


Tl T2 T3 




3-BIT3 


5-3ITS 


N X 8-BITS 


16-BITS 





Figure 7-5. RTU Message Frame Format 



1.3.3 Address Field 

The address field immediately follows the beginning o* 'rame and consists o' 
8-bits (RTU) or 2 characters (ASCII). These bits indicate thi jser assigned aadress 
of the slave device that is to receive the message sent c> the attached master 

Each slave must be assigned a unique address and only tie addressed slave * 
respond to a query that contains its address. When the s:ave sends a response 
the slave address informs the master which slave is communicating, I? 
broadcast message, an address of is used. All slaves interpret this as >- 
instruction to read and take action on the message, but not to issue a resp:- - 
message. 
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1.3.4 function Field 

The function code fie'd tells trie addressed slaves wnat function to oe": — 
Modbus function cooes are specifically aesignea for interacting *ith a PC 
Modbus industrial communicat'Ons svsiem. Table 1-2 lists tne function :::•=£ 
their T-.ea^.ng. and the action tney initiate. 

The high order bit in this ,] e\z s set by tne slave device to indicate that otre- rs- 
a norrr.ai response :s being transmitted tc the Master device. (See Sectior 2 C" = 
oescnption of exceotion responses.) This bit remains if the message is a 
or a norma; response message. 

Table ■•2. Modbus Function Codes 



CODE 


MEANING 


ACTION 


01 


READ COIL STiT^S 


Obtains current status iO\ Z z ~ 
of a group of .ogic coils. 


02 


BEAD INPUT STATJS 


Obtain current status (ON/C rr 
a group of discrete inputs. 


03 


READ HOLDING REGISTERS 


Obtain current binary value : _ e 
or more holding registers. 


04 


READ INPUT REGISTERS 


Obtain current binary value " :~r 
or more input -egisters. 


05 


FORCE SINGLE CC'L 


Force logic coil to a state c' I*, 
or OFF. 


C6 


PRESET SINGLE REGISTER 


Place a specific binary vai_r 
a holding register. 


07 


READ EXCEPTION STATUS 


Obtain the status (ON/OFF- ;- 
eight internal coils whose 
addresses are controller 
ceoendent isee Section 3.7 _ss* 
logic can program these cc = •: 
indicate siave status. Shor 
message length allows rap z 
reading of status. 


08 


LOOPBACK DIAGNOSTIC TEST 


Diagnostic test message se _ : 
slave to evaluate commumca: : - s 
processing. 


09 


PROGRAM (484 ONLY) 


Allows master to simulate ac: :~s 
of programming panel and a:;- 
PC slave logic. 


10 


POLL PROGRAM COMPLETE 
(484 ONLY) 


Allows master to communica:r 
with other slaves if one slave s 
working on lengthy prcgrarr :=.£•. 
Slave is polled periodically :c ~ee 
if its program operation is 
complete. Only issued afte- •. 
message containing functi:- !:•;= 
9 has been sent. 
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Table 1-2. Modbus Function Codes ;cont.) 



CODE 


WEANING 


ACT.C. 


11 


FETCH EVENT COUNTER 
COMMUNICATIONS 


Aliows a master tc -ss-r a 
smgie query and sucsec-ently 
determine whether tre operation 
was successfully per-or^ea. 
esoecialiy when a ccrr- — jmcation 
error occurred on tha: command 
or its response. 


12 


FETCH COMMUNICATIONS 
EVENT LOG 


Aliows a master tc ret' eve a 
communications ever: eg that 
contains information accut each 

ivluUUUb uanbdClltjn W. [fiat 

siave. If a transaction * = s not 
completed, the log o-ov res 

informaliofi aocut :re e"cr that 
oceured. 


13 


PROGRAM 

(1 34/384 . -c- 584) 


. Aliows master to sifr _ = := 
actions of programm.-; panel and 
alter PC slave logic. 


14 


POLL PROGRAM COMPLETE 
(134/384. 464. 584) 


Allows master to com'-_nicate 
with other slaves if ore slave is 
working on lengthy proc'am task, 
oiave is poneo periocicaiiy to see 
if its program operatic- is 
complete. Only issued a*ier a 
message containing a '-notion 


15 


FORCE MULTIPLE COILS 


Forces a series of consecutive 
logic coils to defined C\ or OFF 

ctatoc 


16 


PRESET MULITPLE REGISTERS 


Places specific binar> values into 
a series of consecutive noiding 

ron j ctorc 
< try I a I t;I o. 


17 


REPORT SLAVE I.D. 


41b ws a master to je.r'mme the 
tyce of slave addresser and the 

J I d 1 u O Ul i . i C o ■ a V C 3 - :i^m, 


18 


PROGRAM .534 & Micro 84) 


Allows Master to sim_ ate actions 
or programming pane and alter 
PC state logic. 


19 


RESET COMMUNICATIONS 

1 1 ML/ 

LI N K 


Resets slave to kne*- state 
after non-reccveracie e~or. Resets 
sequence byte. 


20 


READ GENERAL REFERENCE 
(534L ONlY; 


Displays informatics remained in 
extended memory f i ies . 


21 


WRITE GENERAL REFERENCE 
(584L ONi_Yi 


Enters or changes ir*c — 'ation 
contained in extencec — .emory 
files. 


22-64. 


RESERVE! =OR EXPANDED 
FUNCTIONS 
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Table 1-2. Modbus Function Codes {cont / 



CODE 


MEANING 


ACTION 


65-72 


RESERVED p OR USER 
~UNC T lCNS 


Reserved 'or use's -O' cusiom 
functions: mH net se usee by 
GcuiC in future procucts. 


73-TI9 


ILLEGAL FUNCTIONS 




".20-127 


RESERVED 


Reserved for interna! use. 


126-255 


RESERVED 


Reserved for exceDiior resoonses. 



.3.5 Data FieiC 

■ The data field contains information needed by the slave to perform the specific 
function or it contains data collected by the slave in response to a query. This 
information may be values, address re'e r ences. or limits. Fc r examDle. the 
funct.cn code telis the s>ave to read a hold -g register, and the data fie ; d is needec 
to indicate wnich register to start at and r:A many to reaa. The imot(ld«C aacress 
and data information varies with the type and caoacity of PC assoc;atec with tne 
slave. 

3.6 Error Check Field 

This field allows the master and slave devices to check a message for errors in 
transmission. Sometimes, because of eiectrical noise or other interference, a 
message may be changed slightly while it is on its way from one unit to another. 
The error checking assures that the slave or master does not react to messages 
that have changed during transmission. This increases the safety and the 
efficiency of the Modbus system. 



The error check field uses a longitudinal redundancy check i.LPC) in the ASCII 
Mode, and a CPC-16 check in the RTU Moce. (See paragraph 1.2 for a description 
of the two types of error check.) 

if query and response messages could be read in English as they were transmitted, 
the four fields o f the messages would lock iiKe they do in Figure 1-6. (Note that tne 
sending secuence is aiways the same — Address. Function Code. Data, and Error 
Check — relative to the direction.) 



EPRQF CHECK 

INFORMATION USED 3V 
RECE'VING DEVICE TC 
CHECK ?0fl ERRORS 



DAT- 

RElATIVS ACDRE: 
CF REGISTER 
NLM9EP 



F.NC"lCN 



= E-C HOLDING 
= EGISTER 



ADDRESS 

QUERY FC* 
SLAVE 
NUMBER 1 



MCDSJS 
MAS'ER 



ADDRESS 


FUNCTION- 


DATA 


ERROR CHECK 




CODE 






RESPONSE 


!C3| 


VALUE CCA'AINEO 


INFORMATION 


FPCM 


READ HOLDING 


!N SPECi c ED 


USED BY RECEIV- 


SLAVE 


REGISTER 


HOLDING =E3iSTE= 


'NG DEVICE TO 


NUMBER i 






CHECK FOR ERRORS 



Slav 

NO 



Figure 1-6. Simulated Query sr.d Response Messages 
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SECTION 2 
EXCEPTION RESPONSES 



Programming or operation errors are these involving egai data m a message, no 
response from PC to its interface unit, or difficulty r rommumcating witr, a siave. 
Tnese errors result in an exception response fro~ t trer the master computer 
software iMoabus Communications Handler) or tre =>C slave, decending or, trie 
type o* error. The exception response codes are ; 's:e-d in Table 2-1. When a PC 
siave detects one of these errors, it senas a resccse message to the master 
consisting of slave address, function code, error coce and error check fields. To 
indicate that the response is a notification of an er-or. the hign oraer bit of the 
function code is set to 1. Figure 2-1 and 2-2 give an example of an incorrect query 
and the subsequent exception response codes. 



Table 2-1. Exception Resporse Zodes 



cod; 



NAME 



ME-NING 



CI ILLEGAL FUNCTION 



32 ILLEGAL DATA ADDRESS 



C3 ILLEGAL DATA VALUE 



Tre -message function received is 
nc* an allowable action for 
accessed slave. If a poll 
co: — iand was issued, indicates 
nc cogram function preceded it. 

Tr.e address referenced in the 
ca:a field is not an allowable 
access for the addressed slave 
ioca:ion. 

The value referenced in the data 
fie-c is not allowable in the 
accessed slave location. 



05 



FAILURE IN ASSOCIATED 
DEVICE 



ACKNOWLEDGE 



06 BUSY. REJECTED MESSAGE 



T*e slave's PC has failed io 
respond to a message or an 
ao:-.ive error occurred. (See 
Nc:e 1.5 

~~z siave PC has accepted and is 
cccessing the long duration 
program command. Issue a POLL 
PROGRAM COMPLETE message 
tc ' id out when processing is 
fi" sned. A poll message sent to 
the =>C before it is finished will 
res.lt in a rejected message 
resronse. (See Note 2.) 

The message was received without 
er-;-. but the PC is engaged in 
accessing a long duration 
c:c'am command. Retransmit 
late*, when the PC may be free. 
(See Note 2.) 
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Table 2-7. Exception Response Cooes (cont.j 



CODE NAME MEANING 



c: 



NOTE 1 



NOTE 2 



OS 

memory cnecKS memory diis oeing 
accessed. Retries should be 
attempted as the error might not 
recur. If all retries fail, service may 
be required. 



QUERY MESSAGE 



SLAVE 
ADDR 


FUNC 


H.O. 

START 

ADDR 


L.O. 

START 

ADDR 


H.O. 
NO. OF 
COILS 


L.O. 

NO. OF 
COILS 


ERROR 
CHECK 
FIELD 




OA 


01 


04 


A1 


00 


01 


4F 


LRC 



Figure 2-1. Read Coil-Status Query Message 



This query requests the status of Input 1245 in Slave No.10 and if this controller 
was a 1K-484 then this is an invalid input number. Consequently, the following 
error response might be generated: 



SLAVE 
ADDR 


FUNC 


EXCEPTION 
CODE 


ERROR 
CHECK 




OA 


31 


02 


73 


LRC 



Figure 2-2. Read Coil Status Error Response 



The function code field is the original function code with the high order bit set. 
Exception Code 02 indicated an iilegal data address. 



NAK-NEGATIVE The PROGRAM functron jus: 

ACKNOWLEDGMENT reauestec cannot be performed. 

issue ooM tc obtain cetailec 
device-deoenaent error 
information. Vaiid for 
PROGRAM/POLL 13 and 14 only. 

^or function coces 1-19. an EXCPT Code 4 may indicate that oniy part of !re 
associated query vuas processea oe f ; r e an irreccverapie error occurrec within 
the respcnder station. Receipt of EXCF"" Code 4 requires immediate supervisory 
notification. 

The 884 supports exception codes 5 and 6 oniy as device Dependent error 
responses to function code 18. See Appendix A of the 384 Modbus Programming 

F'orocoi manual 

Fe'er tc Appencix A tre scec:'*; rsvice dependent manual for rssccnses 
AOicn can be cctamed after excec:ic- 'espcnse Coces 5. 6. and 7. 

MEMORY PARITY ERROR The Modbus read of extended 
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SECTION 3 

DETAILED EXPLANATION OF MODBUS FUNCTIONS 



The pu r ocse o' :iis section is to define the general forma: *or the specif'c 
commands avai'ac;e tc programners of the Modbus System. ~~,e form of eacn 
query message, a- exampie m ASCII transmission mode and ar explanation of the 
function, tie suer. message performs ^s provided. Normal rescorse messages are 
aiso mciLiCec. 

An overview desertion of the protocol and messages are desc oed in Section 1. 

Messages with 'unction Codes 1-6. 15. & 16 indicate specifically *nich locations) 
m the programmable controller is iare) to be accessed. Function Codes 1. 5. &. 15 
refer to coils OXXXiX)*. Code 2 refers to inputs (1XXX(X)), Code & refers to input 
registers (3XXXiX, . and Codes 3. 6. and 16 refer to holding registers (4XXX(X)). All 
address references in the Modbus messages are numbered re ative to zero. For 
example the firs: holding register in a 584 would be register AQ0C1 and wouid be 
referenced as 0C"C Similarly, coil 00127 would be 0126 (decima = 007E mex). Aii 
numoers in a M:;bus format are entered in hexadecimal. 

The examples c .en in this section will present the protocol ireeoencent of F J 
or ASCII 'rammc consiaerations. See Figures 1-4 and 1-5 for ASC:i & RTU framing 
examples. The programmer implementing the software may use the following 
method to correctly frame the protocol for their specific application. 

The protocol will be presented as much as possible throughout this section in the 
format shown in Figure 3-1. Numbers represented are in hexacecimal. 



ADDR 


FUNC 


DATA 


DATA 


DATA 


DATA 


ERROR 








START 


START 


# OF 


« OF 


CHECK 








REG 


REG 


REGS 


REGS 


FiELD - 








HO 


LO 


HO 


LO 






06 


03 


00 


6B 


00 


03 


89 


LRC 



Figure 3-1. Presentation Example for Protoco 

The exampie e ven is Read Output Registers 4108-4110 for :~e Modbus Slave 
Interface Unit addressed as 06. This message when specifics ly formatted 
either RTU or ASCII will look as follows: 



QUERY 



MESSAGE 




RTU 




ASCII 




Header 




None 






Colon 


Address 




0000 


0110 





6 


Function 




0000 


0011 





3 


Starting 


H.C. 


0000 


0000 








Register 


L.C 


0110 


1011 


6 


B 


Quantity of 


(- O. 


0000 


0000 








Registers 


L.C. 


0000 


0011 





3 


Error 




0111 


0101 


8 


9 


Check 




1010 


0000 






Trailer 




None 




CR 


LF 






8 Bytes Total 


17 Bytes "otal 
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RESPONSt MESSAGE 


nTi i 

P T U 




Ab 




Header 


None 






Coicn 


Address 


0000 


01 10 





6 


Function 


0000 


0011 





3 


Byte Coun: 


0000 


0110 


: 


6 


H.O. 


0000 


0010 





2 


LO. 


OCiO 


1011 


2 


B ' 


Data H.O. 


0000 


0000 








H.O. 


0000 


0000 








L.O. 


0110 


0011 


6 


3 


Error 


CRC 




6 


1 


Check 










Trailer 


None 




CR 


LF 




11 Bytes Total 


23 3ytes Total 





It will a! a ays be the case that the ASCII message in its final form wili be 
approximately twice the length in byies of the comparacie RTU message. 

The Norma! Response message format has an implied or explicit message length 
depending on the Modbus function code. The explicit form is used for variable 
length Responses. The byte count in the response refers to the number of 8-bit (1 
byte) data fields included in the response. In the RTU communication mode, a byte 
of information is transmitted as a single 8-bit character. In the ASCII 
communication mode, each 8-bit ASCII character contains 4 data bits and 4 bits 
for formatting the specific ASCII character sent, consequently two ASCII 
characters are required to transmit 8 bits (1 byte) of information. For examole, 
address 06 is transmitted as '00000110' in the RTU mode, and '011 0000 ' T '011 0110' 
(ASCI 1 and 6) in the ASCII MODE. data data 

This general response format is used when responses are of a variable nature. For 
fixed length responses the byte count field is omitted anc only the data fields are 
supplied. These functions are thought of as implied length functions. See 
Appendix C for implied length summaries. Exception Resoonse message formats 
are discussed in Appendix A of the device specific manuals. 

Table 3-7. Modcus Function Codes Supported By 184/384. 484. & 5S4 Controllers 



function Micro 



Code 


DescrlDtic- 


184/384 


484 


584 


884 


34 


1 


flead Coi! Status 


Y 


Y 


Y 


Y 


Y 


2 


Read Input Status 


Y 


Y 


Y 


Y 


"Y 


3 


Read Hclc.-:g Reg 


Y 


Y 


Y 


Y 


4 


4 


Read Input Reg 


Y 


Y 


Y 


Y 


1 


5 


Force Coi. 


Y 


Y 


Y 


Y 


i 


6 


Load Reg's:er 


Y 


Y 


Y 


Y 


Y 




Read Excectior, 


Y 


Y 


Y 


Y 





Status 
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Table 3-7. Modbus Function Codes Supported By 184/384. 484, & 584 Controllers icont.; 



C->ce 


DescriDtion 


184/384 


484 


584 


884 


34 


5 


Loop 3ack Diagnostic 


Y 


Y 


Y 


Y 


V 


3 


Program 484 


N 


Y 


N 


N 


N 


-.c 


Poll 484 


N 


Y 


N 


N 


N 


A " 


Comm. Event Counter 


Y 


N 


Y 


N 


N 




Comm. Event Log 


Y 


N 


Y 


N 


N 




Program-General 


Y 


N 


Y 


N 


N 


' - 


Poll-Genera! 


Y 


N 


Y 


N 


N 




Fjrce Multiple Coiis 


Y 


Y 


Y 


Y 


Y 




Lead Multiple Regs. 


Y 


Y 


Y 


Y 


Y 


* — 

! . 


Report Slave I.D. 


Y 


Y 


Y 


Y 


Y 


"5 


Program 


N 


N- 


N 


Y 


Y 


i? 


Reset Communication Link 


N 


N 


N 


Y 


Y 


2 - 


Read General Reference 


N 


N 


Y 


N 


N 


•i - 


Write General Reference 


N 


N 


Y 


N 


N 



2." READ OUTPUT STATUS (FUNCTION CODE CI) 

QUERY 

This function allows the user to obtain the ON/OFF status of logic coils i.sed to 
control discrete outputs from the addressed slave only. Broadcast moae s not 
supported with this function code. In addition to the slave address and ?_-cticn 
fields, the message requires that the information field contain the ini: a. cc 
address to be read (Starting Address) and tne number of locations that ce 
interrogated to obtain status data. 

The addressing allows up to 2000 coils to be obtained at each request: ~: ^ever. 
the specific slave device may have restrictions that lower the maximum ;.antity 
(see Appendix B). The coils are numbered from zero; (coil number 1 = ze r c. coil 
number 2 = one, coil number 3 = two, etc.). 



Figure 3-2 is a sample reaa output Status Request to read coils 0020 to 005= from 
slave device number 17. 



ADDR 


FUNC 


DATA 


DATA 


DATA 


DATA 


ERROR 








START 


START 


# OF 


# OF 


CHECK 








PT 


PT 


PTS 


PTS 


FIELD 








HO 


LO 


HO 


LO 






11 


. 01 


00 


13 


00 


25 


B6 





Figure 3-2. Read Output Status Query Message 
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RESPONSE 

An example resoo^se to Read Output Status is as shown in Figure 3-3. The data 
is pacKeo one on io f eacn coil. The response includes the slave access, function 
code, quantity of data characters, tne data characters, and erro r ~iecKing. Data 
will be oackec with one bit tor eacn coi! i 1 = ON. G = OFF'i. The »c» order bit of 
the first cnaracte 1- zznxa.r.s tne aodre'-^d coii. and the remainde r 'glow. For coil 
quantit.es tnat are net even multiples o - eight, the iast characters be filled m 
witr zeros at hicn crcer end. The quantity of data characters is a;*ays specified 
as quantity of RTU characters, i.e.. the numDer is the same whetne- RTU or ASCII 
;s usee. 

Since the slave inte r< ace device is serviced at the end of a control e-'s scan, data 
will reflect coil status at the end of tne scan. Some slaves will lirr : the quantity 
of coils providec each scan: thus, for large coil quantities, multiple PC 
transactions must as made using coil status from sequential scans. 



ADDR 


FUNC 


BYTE 
COUNT 


CA-A 
CC'_ 

S i A. • ^S 
20-27 


DATA 
COIL 
STATUS 
28-35 


DATA 
COIL 
STATUS 
36-43 


DATA 
COIL 
STATUS 
44-51 


DATA 
COIL 
STATUS 
52-56 


ERROR 
CHECK 
FIELD 


11 


01 


05 


' CD 


6B 


B2 


0E 


1B 


D6 



Figure 3-3. Read Output Status Response Message 



The status of coils 20-27 is shown as CD(HEX) = 1100 1101 (Binary :. Reading left 
to right, this shows that coils 27. 26. 23, 22, and 20 are all on. The other coil data 
bytes are decoded similarly. Due to the quantity of coil statuses rec jested, the last 
data field, which is snown as 1B (HEX) = 0001 1011 (Binary), conta ns the status 
of only 5 coils (52-55; instead of 8 coils. The 3 ieft-most bits are provided as zeros 
to fill the 8-bit format. 

3.2 READ INPUT STATUS (FUNCTION CODE 02) 

QUERY 

This function allows the user to obtain the ON/OFF status of discrete inputs in the 
addressed slave PC Broadcast mode is not supported with this function code. In 
addition to the slave address and function fields, the message requires that the 
information field contain the initial input address to be read (Startirq Address) and 
the numoer of locations that will be interrogated to obtain s'tatus rata. 

The addressing allows up to 2000 inputs to be obtained at each request; however, 
the specific slave device may have restrictions that lower the majumum quantity 
(see Appendix B). The inputs are numbered from zero; (input 10OC* = zero, input 
10002 = one, input 10003 = two, etc., for a 584). 

Figure 3-4 is a sample read input Status Request to read inputs "0197 to 10218 
from 584 slave numoer 17. 



ADDR 


FUNC 


DATA 


DATA 


DATA 


DATA 


ERROR 








START 


START 


# OF 


# OF 


CHECK 








PT 


PT 


PTS 


PTS 


FIELD 








HO 


LO 


HO 


LO 






11 


02 


00 


C4 


00 


16 


13 


LRC 



Figure 2-*. Read Input Status Query Message 
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RESPONSE 

An example response to Read Input Status is as shown in Figure 3-5. The data is 
packed one bit for each input. 

T he response includes the slave adcress. function code, quantity cf data 
characters, the data characters, and error checking. Data will be cacKec with one 
0»! f or each incut = ON. = OFF:. Tr.e lower oraer bit of tne first character 
contains tne aaaresseo input, and the remainqer foliow. For input quantities mat 
a r e not even multiples of eight, the last characters will be filled ir. witn zeros at 
high orcer end. The Quantity of data cha-acters is always specified as a Quantity 
of RTU characters, i.e.. the number is the same whether RTU or ASCIi is usee. 

Smce the slave interface device is serviced at the end of a controller's scan, data 
wii: reflect input status at the end of the scan. Some slaves will limit the quantity 
of inputs provided each scan; thus, for large coil quantities, multiple PC 
transactions must be made using coil status from sequential scans. 



A OCR 


FUNC 


BYTE 
COUNT 


DATA 
DISCRETE 
INPUT 
10197-10204 


DATA 
DISCRETE 
INPUT 
10205-10212 


DATA 
DISCRETE 
INPUT 
10213-10218 


ERROR 
CHECK 
FIELD 




11 


02 


03 


AC 


DB 


35 


2E 


LRC 



Figure 3-5. Read Input Status Response Message 



The status of inputs 10197-10204 is shown as AC (HEX) = 1010 1100 (Binary). 
Reading left to right, this shows that inputs 10204, 10202, 10200, and 10199 are all 
on. The other input data bytes are decoded similarly. 

Due to the quantity of input statuses requested, the last data field which is shown 
as 35 HEX = 0011-0101 (Binary) contains the status of only 6 inputs (10213-102180 
instead of 8 inputs. The two left-most bits are provided as zeros to fill the 8-bit 
format. 

3.3 READ OUTPUT REGISTERS (FUNCTION CODE 03) 

QUERY 

Read output Registers (03) allows the user to obtain the binary contents of holding 
registers in the addressed slave. 

These registers can store the numerical values of associated timers and counters 
which can be driven to external devices. 

The addressing allows up to 125 registers to be obtained at each request; however, 
the specific slave device may have restrictions that lower this maximum quantity 
(See Appendix D). The registers are numbered from zero (40001 = zero, 40002 = 
one, etc.). 

Broadcast mode is not allowed. 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



The below examDle reads registers 40108 through 401 10 from slave 584 number *7. 



ADDR 


FUNC 


DATA 


DATA 


DATA 


DATA 


ERROR 








START 


START 


# OF 


# OF 


CHECK 








REG 


REG 


REGS 


REGS 


FIELD 








HO 


LO 


HO 


LO 






11 


03 


00 


6B 


00 


03 


7E 


LRC 



Figure 3-6. Reap Output Register Query Message 



RESPONSE 

The addressed slave responds with its address and the function code, followec ry 
the information field. The information field contains 2 bytes describing the 
quantity o< data bytes to be returned. The contents of the registers reauested 
'DATA; are two bytes each, witr the binary content right justified within tacr »air 
of characters. The first byte incudes the high order bits and the second, f e ca 
order bits. 

Since the slave interface device is normally serviced at the end of the controi.5' s 
scan, the data will reflect the register content at the end of the scan. Some slaves 
will limit the quantity of register content provided each scan: thus for large register 
quantities, multiple transmissions will be made using register content from 
sequential scans. 



In the below example the regisiers 40108-40110 have the decimal contents 555. 0, 
and 100 respectively. 



ADDR 


FUNC 


BYTE 


DATA 


DATA 


DATA 


DATA 


DATA 


DATA 


ERROR 






COUNT 


OUTPUT 


OUTPUT 


OUTPUT 


OUTPUT 


OUTPUT 


OUTPUT 


CHECK 








REG 


REG 


REG 


REG 


REG 


REG 


FIELD 








H.O. 


LO. 


H.O. 


LO. 


H.O. 


LO. 










40108 


40108 


401 09 


40109 


40110 


40110 




I " 


03 


06 


02 


2B 


00 


00 


00 


64 


WW 



Figure 3-7. Read Output Register Response Message 



3.4 READ INPUT REGISTERS (FUNCTION CODE 04' 

QUERY 

Function Code 04 obtains the contents of the controller's input registers. T-ese 
locations receive their values from devices connected to the I/O structure arc can 
only be referenced, not altered from within the controller or via the Modbus. The 
addressing allows up to 125 registers to be obtained at each request; however. :ne 
specific slave device may have restrictions that lower this maximum quamity See 
Appendix B). The registers are numbered from zero (30001 = zero, 30002 = one. 
etc.). Broadcast mode is not allowed. 



DETAILED EXPLANATION OF MODBUS FUNCTIONS 



The below example reauests the contents of register 3009 in 484 slave number 17. 
In the response the contents is decimal value 1337. 



ADDR 


FUNC 


DATA 


DATA 


DATA 


DA T A 


ERROR 








START 


START 


# CP 


# O- 


CHECK 








REG 


REG 


REGS 


PEGS 


FIELD 








HO 


LO 


HO 


LC 






11 


C4 


00 


08 


00 


01 


E2 


LRC 



Figure 3-3. Read Input Register Query Message 



=ES=ONSE 

T ~e addressed slave responds with its address 3^: the function code followed by 
:~s information field. The information fielc :"tains 2 bytes describing :re 
c-a~x«ty o' cata oytes to be returned. The cc":t"ts of the registers recuestec 
•'EATAi are 2 bytes each, with the binary contert -;nt justified within each pair c } 
c.-a-acters. The first byte includes the high orde' r :s and the second, the low order 
tits. 

Since the slave interface is normally serviced at trie end of the controller's scan, 
the data will reflect the register content at the eno of the scan. Each PC will limit 
the quantity of register contents provided eac- scan; thus for large register 
Quantities, multiple PC scans will be required, anc the data provided will be from - 
secuential scans. 



in the below example the register 3009 contains the decimal value 0. 



ADDR 


FUNC 


BYTE 


DATA 


DATA 


ERROR 








COUNT 


INPUT 


iNPUT 


CHECK 










REG 


PEG 


FIELD 










HO 


t r\ 












3009 


3009 






11 


04 


02 


00 


00 


E9 


LRC 



Figure 3-9. Read Input Register -esoonse Message 



3.5 FORCE SINGLE COIL (FUNCTION CODE 05) 

CAUTION 

COMMAND (05) WILL OVERRIDE BOTH PC MEMORY 
PROTECT AND COIL DISABLE STA~E 

CUERY 

This message forces a single coil either ON or 0". Any coil that exists within the 
controller can be forced to either state (ON or CF-i. However, since the controller 
is actively scanning, unless the coil is disabled, the controller can also alter the 
state of the coil. Coils are numbered from zero 'c: . 0001 = zero, coil 0002 = one. 
e::.;. The data value 65.280 (FF00 HEX) will set t~e coil ON and the value zero will 
tL— it CFF; ail other values are illegal and wi: "t effect that coil. 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



The use of slave address 00 (Broadcast Mode) will force all attached slaves to 
modify the desired coil. 

NOTE 

^unctions 5.6. 1 5 and 16 are the only messages (Other than 
Looocack Diagnostic Test) tha: will oe recogmzeo as valid 
for broadcast. 

The below example is a reaues* to slave number 17 to turn 
ON coil 0173. 



ADDR 


FUNC 


DATA 


DATA 


DATA 


DATA 


ERROR 








COIL 


COIL 


ON 




CHECK 








# 




OFF 




FIELD 








HO 


LO 


IND 








11 


05 


00 


AC 


F = 


00 


3F 


LRC 



Figure 3-10. Force Single Coii Query Message 



The normal response to the Command Request is to retransmit the message as 
received after the coil state has been altered. 



ADDR 


FUNC 


DATA 


DATA 


DATA 


DATA 


ERROR 








COIL 


COIL 


ON 




CHECK 








# 


# 


OFF 




FIELD 








HO 


LO 










11 


05 


00 


AC 


FF 


00 


3F 


LRC 



Figure 3-11. Force Single Coii Response Message 



The forcing of a coil via Modbus function 5 will be accomplished regardless of 
whether the addressed coil is disabled or not. 

NOTE 

The Modbus protocol does not include standard functions 
for testing or changing the DISABLE state of discrete inputs 
or outputs. Where applicable, this may be accomplished via 
device specific Program commands. See function Codes 9 
and 13. 

One additional caution: Coils that are urprogrammed in the controller logic 
program are not automatically cleared upon power up. Thus, if such a coil is set 
ON by function Code 5 and (even months later), an output is connected to that coil, 
the output will be "hot". 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



3.6 PRESET SINGLE REGISTER .'FUNCTION CODE 06) 

CAUTION 

-unction (06) will override controller memory p'otect 

QUERY 

Function '06 a!le*S the user to modify the contents of a ^cidinc registe r . Any 
holding regiSTr' that exists within the controller can have its center :s changed by 
tms message. However, since the controller is actively scanning, it aiso can alter 
the content c* any hoiaing register at any time. The values are pre.' ided in binary 
up to the maximum capacity of the controller (10-bit for 484 a~3 l6oit for 184/384 
and 584); unused high order bits must be set to zero. When usee with slave address 
zero 'Broadcast mode) all slave controllers will load the specr'ed register with the 
contents spec : ied. 

NOTE 

= --ctior.s 5. 6. 15 and 16 are tne only messages ic:~er th an 
Lccocack Diagnostic Test) that will be recognizee as va..id 

for orcadcast. 



ADDR 


FUNC 


DATA 


DATA 


DATA 


DATA 


ERROR 








REG 


REG 


VALUE 


VALUE 


CHECK 








# 


# 






FIELD 








HO 


LO 


HO 


LO 








06 


00 


87 


03 


9E 


CT 


LRC 



Figure 3-12. Preset Single Register Query Message 



RESPONSE 

The normal 'esoonse to a preset single register request is tc -etransm.it the gu 
message af:e r the register has been altered. 



ADDR 


FUNC 


DATA 
PEG 
4136 
HO 


DATA 
REG 
4136 
LO 


DATA 


DATA 


ERROiR 
CHECK 
FIELD 




11 


06 


00 


87 


03 


9E 


C1 


LRC 



Figure 3-13. Preset Single Register Response Message 



3.7 READ EXCEPTION STATUS (FUNCTION CODE 07) 
QUERY 

In many cases a short message requesting the status o' certain events in a 
controller is cesired. The read exception status code is designed to provide this 

functionality. 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



Function Code 7 allows the user to interrogate the status of eight.coils within the 
controller. These coils can be programmed to hold information of the PC's control 
situation (e.g.. machine ON/OF-, neads retracted, safeties satisfied, receipt in 
process error conditions exist, etc.). Slave address 00 (Broadcast Mode) is not 
supponed with the exception Status Request Message. 

The e<gn: coil statuses returned Dy this command aepend on the slave PC type. 
The states of coils 1-8 are returned if the slave PC is a 584. 184/384. or Micro 84 
and tne status of coiis 257-264 are returned if the slave PC is a 484. if the slave 
PC is an 884, the states of coils 761-768 are returned. See Table 3-2 for special coil 
assignments. 



Table 3-2. Exception Status Special Coil Assignments 



Contrciler 


Coil No. 


Assignment 









4P 


257 


Battery Status 




761 


Battery Status 


m 


762 


Memory Protect Status 




763 


Remote I/O Health Status 









The below example displays a request to slave number 17 to respond with 
exception status. 



ADDR 


FUNC 


ERROR 
CHECK 
FIELD 




11 


07' 


E8 


LRC 



Figure 3-14. Read Exception Status Query Message 
*No data fields required for this function. 
RESPONSE 

The "-mal response contains the status of the eight coils, packed into one data 
byte, cne bit per coil. 



SLAVE 
ADDR 


FUNC 


COIL 
DATA 


ERROR 
CHECK 
FIELD 




11 


07 


6D 


7B 


LRC 



Figure 3-15. Read Exception Status Response Message. 

In this example, if slave 17 is a 484 controller, since 6D (HEX) = 0110 1101 (Binary), 
coil 257 is ON (batteries OK), coils 259, 260, 262, and 263 are ON and coils 258, 261, 
and 254 are OFF. The user determines what the last 7 coils are programmed to 
reflect. 
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DE-AILED EXPLANATION OF MODBUS FUNCTIONS 



In the 184/384 and 584 function Code 7 reads coils 1-8. The 184/384 PC line uses 
core memory, therefore battery back-up for memory retention is not recuired and 
all eight coils are available for the user program. The 584 has a user configurable 
battery OK coii. The user may configure it as any of coils 1-8 such that it is reac 
by this ccmmanc. 

■ 

LOOPBACK TEST (FUNCTION CODE 81 
QUERY 

The purpose of the Loopback Test is to test the communications system: it does 
not affect the content o' the controller. 

Variations in the response may indicate faults in the Modbus system. The 
information field contains 2 bytes for the designation of diagnostic code followed 
by 2 bytes to designate the action to be taken. 

The use of the Loopback Test also allows the user to fetch the Diagnostic Register 
contents, a valuable tocl for testing system operation. In addition, tne use of 
diagnostic Codes 11-13 enable the user to interrogate the Modbus S a.e s Bus 
message. Bus CPC error and Bus Exception error counters. These eountf'S suppiy 
information that is use : -. for communications error analysis. 

The next four diagnostic Codes (14-17) enable the user to obtain counter 
information from the slave associated controller. 

These counters accumulate data on the number of messages received and acted 
upon; the number of messages requiring no response; the number of issued not 
acknowledge responses: and, number of times the device was busy when a 
program command was issued. The last codes (18-20) associated with loopback 
Test are reserved for Gould use. 



An example of a Loopback Test given below requests a simple return of the query 
message (Diagnostic Code 0) sent to slave number 17. 



ADDR 


FUNC 


DATA 
DIAG 
CODE 
HO 


DATA 
DIAG 
CODE 
LO 


DATA* 


DATA' 


ERROR 
CHECK 
FIELD 




11 


08 


00 


00 


A5 


37 


0B 


LRC 



'These are considered to be the information fields for diagnostic mode. 
Figure 3-16. Loopback Test Return Query Data Query 



RESPONSE 



ADDR 


FUNC 


DATA 
DIAG 
CODE 
HO 


DATA 
DIAG 
CODE 
LO 


DATA 


DATA 


ERROR 
CHECK 
FIELD 




11 


08 


00 


00 ■ 


A5 


i 

37 


0B 


LRC 



Figure 3-17. Loczzack Test Return Query Data Response 
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DIAGNOSTIC CODES (SEE TABLE 3-3 FOR CODES SUPPORTED FOR EACH PC) 



HEX dec:ma^ 

00 OC = Return Query Data 

01 Ci = Restart Comm Option <:no response) 

02 C2 = Return Diagnostic Register 

03 03 = Change Input Delimiter Character 

04 04 = Force Slave to Listen Only Mode 

OA "0 = Clear Counters and Diagnostic Register 

0B = Return Bus Message Coun: 

0C "2 = Return Bus CRC Error Coun: 

0D 13 = Return Bus Exception Error Count 

0E 14 = Return Slave Message Count 

OF 15 = Return Slave No Response Count 

10 16 = Return Slave NAK Count 

11 17 = Return Slave Busy Count 

12 18 = Return Bus Character Overrun Count 

13 19 = Return Overrun Error Count 

14 20 = Clear Overrun Error Count and Flag 



NOTE 

Codes 5-9 and 21-65,535 are illegal codes. 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



Table 3-3. Supported Diagnostic Cooes (or the Loopback Test Modbus Function 



OiAG 
CODE 


DEFINITICN 


184/384 


484 


584 


! 

! 884 


MICPC 
34 


OC 


Return Query Data 


Y 


V 


Y 


i 


Y 


C1 


Restart Comm Option (No response 
from siave com. octicr. Error = 199) 
QO/FF s HaitvContmue on Error 


Y 


Y 


Y 


Y 


Y 


C2 


Return Diagnostic Register 


Y 


Y 


Y 


Y 


Y 


03 


Change ASCII Input Den miter 


Y 


Y 


Y 


N 


N 


C4 


Force Listen Oniy Moce. 


Y 


Y 


Y 


I 

Y 


!t 


C5-C9 


RESERVED 


Y 


Y 


Y 


N 


N 


10 


Clear Counters and Diagnostic 
Register 


Y 


Y 


CLEARS N 
CTRS ONLY 


N 


11 


Return Bus Message Count 


Y 


v 


Y 


N 


N 


12 


Return Bus Comm. Error Count 


Y 


Y 


Y 


N 


N 


13 


Return Bus EXCP Error Count 


Y 


Y 


Y 


N 


N 


14 


Return Slave Message Count 


Y 


Y 


Y 


N 


N 


15 


Return Siave No Response Count 


Y 


Y 


Y 


N 




16 




Return Slave NAK Count 


Y 


Y 


Y 


N 


N 




Return Slave Busy Count 


Y 


Y 


Y 


N 


N 


,8 


Return Bus Char. Overrun Count 


Y 


Y 


Y 


N 


N 


,9 


Return Overrun Error Count 


N 


N 


N 


Y 


N 




Clear Overrun Error Count • Flag 


N 


N 


N 


Y 


N 


21-65, 
535 


RESERVED 


NA 


NA 


NA 


NA 


NA 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



DIAG CODE 

FUNCTION INFORMATION FIELD 

h C L.Q. H.C. L.O. 



OC OC ANY DATA 



RETURN QUERY DATA 

The cata passed in the information fielc will be returned to the master via the 
addressee Mocsus slave. The entire message returned should ce identical :z :ne 
message transmitted by the master, field-per-field. 



DIAG CODE 

FUNC'ION INFORMATION FIELD 

H.C. LO. HO. L.O. 



FF 00 
RESTART COMM. OPTION 

This code causes the peripheral port to be reset and all counters to be cleared. If 
' CONTINUE ON ERROR" (FF00) is specified, the COMM EVENT LOG wii! be 
cleared. A normal response is sent before the restart is executed. If the por. is in 
Listen Only Mode *hen the Restart command is received, no response wi" be 
initiated. Restart is the only command that will bring the port out of Listen only 
Mode. If this command is received, a restart is attempted, executing the powe r -up 
confidence tests. Successful completion of these tests will put the unit back ir. on- 
line mode, with the cause c' entry into LCM saved in the Diagnostic Register. 



DIAG CODE 




^UNCTION 


INFORMATION FIELD 


H C L.O. 


H.O. L.O. 


:: 02 


00 00 




RETURN DIAGNOSTIC REGISTER 




This code returns a 16-bit diagnostic register. See Tables 3-2, 3-3, 3-4, 3-4A i 3-4B 




for assignment of bits in the ciagnostic register for each type of slave cor**2iIer. 


DIAG CODE 




FUNCTION 


INFORMATION FIELD 


H.C. L.O. 


H.O. L.C 



OC 03 DATA 00 

CHAR 

CHANGE INPUT DELIMITER CHAR. 

The character passed in the ^formation field provides a means to alter : 
character as the delimiter :-aracter in an ASCII message. 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



DIAG CODE 
FUNCTION 
rC LO. 


INFORMATION FIELD 

H.O LO. 


DC 04 


00 00 
FORCE SLAVE TO LISTEN ONLY MODE (LOMi 

No response is issued. When LOM is enterec. all active controls are immediately 
turned off and the Ready watcndog timer is allowed to expire, locking these 
controls off. This isolates a failed unit from other stations on the line, allowing the 
others to continue full communication. It also prevents a failed communications 
port from interfering with the local application. 

While in LOM the Modbus received data is monitored (but no responses are 

transmitted). The only query that will be recognized and orocessed while in LOM 
is a maintenance -estart command (function Code 8. diagnostic Coae 


DIAG COTE 
FUNCTION 
HO 1 O 


] 

INFORMATION FIELD 
HO L O 


00 OA 


00 00 
CLEAR COUNTERS AND DIAGNOSTIC REGISTER 

All counters and the diagnostic register are cleared to zero from their present .alue 
except in a 584 where the diagnost.c register is not cleared. Counters are also 
cleared by power up. 


DIAG CODE 
FUNCTION 
H.O. LO. 


INFORMATION FIELD 
H.O. LO. 


00 0B 


00 00 
RETURN BUS MESSAGE COUNT 

The information field returns with the number of messages that the addressed 
Modbus slave interface has processed since the last restart was issued (or power 
up). 


DIAG CODE 
FUNCTION 

H.O. LO. 


INFORMATION FIELD 
H.O. LO. 


00 OC 


00 00 
RETURN BUS CRC ERROR COUNT 

The information field returns with the number of CRC errors encountered for the 
addressed Modbus slave interface unit since the last restart or power up was 

issued. 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



DIAG CODE 

FUNCTION INFORMATION FIELD 

HO. L.O. H.O. L.O. 



00 0D 00 00 



RETURN BUS EXCEPTION ERROR COUNT 

The information field returns to the master with the number of exception codes 
returned by the adaressed Modbus slave interface unit since the iast restart of 
power up was issued. 



DIAG CODE 

FUNCTION iNFORMATION FIELD 

H.O. L.O. H.O. L.O. 



j0 0E 00 00 



RETURN SLAVE MESSAGE COUNT 

The information field returns to the master with the number of messages which 
were addressed to the PC since the last restart or power up was issued. 



DIAG CODE 

FUNCTION INFORMATION FIELD 

H.O. L.O. H.O. LO. 



00 OF 00 00 

RETURN SLAVE NO RESPONSE COUNT 

Returns in the information field the number of times the attached PC has failed to 
respond to the interface unit since the addressed Modbus slave last restart or 
power up was issued. 



DIAG CODE 

FUNCTION INFORMATION FIELD 

H.O. L.O. H.O. L.O. 



00 10 00 00 



RETURN SLAVE NAK COUNT 

Returns in the information field the number of times the attached PC responded 
to the addressed Modbus slave interface unit with a NAK (Negative 
Acknowledgment) since the last restart, clear counters, or power up was issued. 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



D!AG CODE 
FUNCTION 
HO L.O. 



INFORMATION FIELD 
HO. L.O. 



GC 1 * 



OC 



OC 



RETURN SLAVE BUSY COUNT 

Returns m nt information fieid the number of times the i 
to tne ascressed Modbus slave interface unit as ousy sir; 
couriers, z' power up was issued. 



cached PC responded 
= :ne last restart, clear 



DIAG CODE 
FUNCTION 

H.C. L.O. 



INFORMATION FIELD 

H C. L.O. 



00 12 



CC 



00 



RETURN BUS CHARACTER OVERRUN COUNT 

Returns in the information field the number of times a message was not handled 
due to cha'acters arriving at the UART faster than they cc_;:d be stored or loss of 
a character due to a hardware malfunction. 



DIAG CODE 
FUNCTION 
H.O. L.O. 



INFORMATION FIELD 
H.O. L.O. 



00 13 



00 



00 



RETURN OVERRUN ERROR COUNT 

Returns in :ne information field the number of times a Mccdus message was 
handled a: the Modbus IOP due to a character overrun e-or. 



DIAG CODE 
FUNCTION 
H.O. L.O. 



INFORMATION FIELD 
H.O. L.O. 



00 14 



0C 



00 



CLEAR OVERRUN ERROR COUNT AND FLAG 

Clears the overrun error count and the flag which is se: a hen the error count is 
non-zero. The state of the error flag is shown in bit o of ire diagnostic register of 
the 884 (see Table 3-7A). 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



Table 3-4 Diagnostic Register Bit Assignments for the 184/384 Controller 

Tre following information is contained in the diagnostic register « bit 15 is the high 
o r ce r bit and the description indicates the meaning wnen the bit is): 



E 


utoLnlr 1 IUN 


C 


Continue On Error 




Run Light Failed 




T-Bus Test Failed 




Asynchronous Bus Test Failed 


- 


Force Listen Only N ode 






z 


Scare 


5 


Scare 


I 


ROM Chip number Test Failed 


£ 


Continuous ROM Checksum Test in Execution 




ROM Chip number 1 Test Failed 


1 c 


POM Chip number 2 Test Faiiec 




ROM Chip number 3 Test Failed 


" 2 


RAM Chip 5000-53FF Test Faiiec 


■* ~ 


RAM Chip 6000-67FF Test Faiiec 'E*en Addresses) 


*- 


RAM Chip 6000-67FF Test Faiiec Odd Addresses) 


is 


Timer Chip Test Failed 




Table 3-5. Diagnostic Register Bit Assignments for the 484 Controller 


T-c 


4 f*i\ \ r\\ki \ nn infrir m o t i /■» n ic rr^ntainoH in tho Hiannrctir rani c tor / R i t 1 ^ ic f ho hinh 
i Ul 1 U W 1 1 1 y iinuniiduuii lo OUIIldll ICU 1 1 1 UlC UlaUHOoUU I Cyl jicl [ □ 1 1 1 j lo U ) c lliyil 


crc; 


ir bit and the description indicates the meanirg when the bit is set): 


BT 


DESCRIPTION 


C 


Continue on error 


i 


CPU test or run light failed 


2 


Parallel port test failed 




Asynchronous bus test failed 
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Table 3-5 Diagnostic Register Bit Assignments for the 484 Contro'ne' cont.l 



Bit description 

• T.r-e r test failec 

5 Tir^e' i test failed 
£ Ti—.er 2 test failed 

7 ROM chiD 0O00-07FF test failed 

6 Con:inuous ROM checKsum test in execution 
S PCM chip 0800-OFFF test failed 

1C PCM cnip 1000-17F= test failed 
= CV cmc 1300-1FFF test faiied 

12 F.AM chip 400 -40FF test faiied 

13 PAM chip 4100-41FF test failed 

14 RAM chip 4200-42FF test failed 

15 RAM chip 4300-43FF test failed 



Table 3-6. Diagnostic Register Bit Assignments for the 584 Zor.:roller 

The following information is contained in the diagnostic register (Bit 15 is the high 
order bit and the description indicates the meaning when the bit is set): 



BIT DESCRIPTION 

Illegal configuration 

1 EacKup checksum error tin high-speed RAM) 

2 Logic checksum error 

3 Invalid node type 

4 invalid traffic cop type 

5 CPU/Solve diagnostic failure 

6 Reai time clock failure 

7 Watchdog timer failure (scan time exceeded 250 milliseconds) 

8 No end of logic node detected, or number of end c' segment 
AsrtJs (DOIO) does not match number segments configured 
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DETAILED EXPLANATION OF MODBUS FUNCTIONS 



Table 3-6. Diagnostic Register Bit Assignments for the 53<* Controller tcont.l 



BIT 


DESCRIPTION 


5 


State RAM test failec 


10 


Start of Network (SON) did not begin segme'-: 


"M 


Bad oraer of solve table 


12 


Illegal peripheral intervention 


13 


Dim awareness flag 


1 A 


1 lm iCfiH 


15 


Peripheral Port 'STOP" see NOTE) 


Tabie 2-~ 


. Diagnostic Register Bit Assignments For the 884 Controller 


The following 


nformation is contained in the diagnostic register (bit 15 is the high 


order bit anc the description indicates the meaning when tne bit is set): 


Bit 


Description 


15-9 


Reserved for future options failure information 


8 


Set if PC SCAN TASK has exceeded its time slice (e.g., too much 




user logic). 

■ 


7 


Set if at least one table RAM checksum failed 


6 


Mam CPU failed 


5 


Remote IO failure 


4 


Ourbus IOP failure 


3 


Modbus option failure 


2 


Modbus IOP failure 


1 


Modbus option overrun errors flag 





Modbus IOP overrun errors flag 



NOTE Denotes "SOFT" stop, which was induced in a controllea manner. All other STOP'S 
are Classified as errors. 
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3.9 FETCH COMMUNICATIONS EVENT COUNTER (FUNCTION CODE 11) 
QUERY 

Fetch Event Counter returns a 2 pyte status word and a 2 byte even! counter 

The even: ccunte r . controllec Dy the PC. gets incremented once fo* ever. 
su'Ce-sfSfiil message completion (it will no? be incremented tor exceeds - 
resconses. cci ; c fetch event counter commandsi. The intent is to prcvice a 
means .vnereDy a master can issue a singie query and subsequently determine 
wnether the operation was successfully performed, especially wnen a 
communication error occurrec on that command or its response. 

The event counter may be reset py issuing a loopback function (8) diagnostic Ccce 
10 (clear counters) or a diagnostic Code 1 (restart comm with halt option;. 

The status word will be set to all ones if a previously issued program commanc 
is still being processed 'a busy condition). Otherwise, the status word is set tc 

zero. 



ADDR 


FUNC 


ERROR 
CHECK 
FIELD 




11 


OB 


E4 


LRC 



Figure 3-18. Fetch Event Counter Query Message 

RESPONSE 

In this example response the status word indicates a program function is still in 
progress and 264 (108 Hex) events have been counted by the controller. 



ADDR 


FUNC 


HO 

STATUS 


LO 

STATUS 


HO 

EVT CNT 


LO 

EVT CNT 


ERROR 
CHECK 
FIELD 


• 


11 


OB 


FF 


FF 


01 


08 


DD 


LRC 



■ Figure 3-79. Fetch Event Counter Response Message 



NOTE 

This command is not supported by the following model 
PC's: Micro 84, 484 and 884. 

3.10 FETCH COMMUNICATIONS EVENT LOG (FUNCTION CODE 12) 

QUERY 

Fetch Communication Event log returns a 2 byte status word, a 2 byte ever: 
ccunter. a 2-Dyte message counter, and 64 event bytes. 

The status /.ord and event byte are identical to that returned in function Fetcr. 
Event Counter (11). 

The message counter returns the number of messages which the controller 
processed since the last restart with halt option or power up. It is identical to da:a 
returned in function Loopback diagnostic code bus message counter (Function 

diagnostic Code 11). 
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The event bytes are a circular array, one byte of information corresponcirg to each 
Bus send or receive oceration iand certain internal operations) for that controller. 
The status bytes are entered in cnronological order. Any wrap-arounc v. ii always 
overwrite the oldest status byte with the current one. The maximum s ze of tne 
communication event aray is 64 bytes. 

Event oytes may be any of 4 types: 

A! Slave Bus Receive : byte is stored when query is received (before processing). 

Bit • Reserved 

Bit 1 • Set if Comm Error 

Bit 2 - Reserved 

Bit 3 - Reserved 

Bit 4 - Set if Character Overrun 

Bit 5 • Set if in Listen Only Mode 

Bit 6 - Set if Broactast 

Bit 7 • 1 

3) Slave Bus Send : byte is stored when processing and/or response s -inisned 
if one was startec. 

Bit - Set if Read Exception sent (Exception Code 1-3) 

Bit 1 • Set if Slave Abort Exception sent (Exception Code 4) 

Bit 2 - Set if Slave Busy Exception sent (Exception Code 5-6) 

Bit 3 - Set if Slave Program NAK Exception sent (Exception Code 7) 

Bit 4 - Set if Write Timeout Error has occurred. 

Bit 5 - Set if in Listen Only Mode 

Bit 6 - 1 

Bit 7 - 

C) Entered Listen On'\ Mode : Byte is stored whenever Listen Oniy Mode is 
entered. 

Bit - 
Bit 1 - 
Bit 2 - 1 
Bit 3 • 
Bit 4 - 
Bit 5 - 
Bit 6 - 
Bit 7 - 

HEX Value = 20 



D) 



Mode 


'. Ent 


Bit - 





Bit 1 - 





Bit 2 - 





Bit 3 - 





Bit 4 





Bit 5 - 





Bit 6 - 





Bit 7 - 






on error 
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ADDR 


FUNC 


ERROR 
CHECK 
FIELC 




11 


OB 


E* 


LRC 



figure 3-20 tetch Communications Even: Log Query Message 
RESPONSE 

in this exarr.pie response, statue- *ord indicates nc event is in progress. 264 iTOfi 
HEX 1 ! events nave been counted by the contrc:er. The message counter is set to 
288 i120 HEXi. The most recent event byte is ''Entered Listen Only Mode" type (20). 
The seconc most recent oyte is a "Com Restart' type (00). 



ADDR 


<=UNC 


BYTE 
CN~ 


HO 

STATUS 


LO 

STATUS 


HO 

EVT CNT 


LO 

EVT CNT 


HO MSG 
CN~ 


LO MSG 
CNT 


N 

DATA 


N-1 
DATA 


ERROR 

CHECK 
FIELD 


I ' 


OC 


*8 


00 


00 




01 


08 


c- 


20 


20 


00 


53 



Figure 3-21. Fetch Communications Event Log Resoonse Message 

NOTE 

This Modbus command is not supported by Gould PC model 
types 484, 884, and Micro-84. 

3.11 -ORCE MULTIPLE COILS (FUNCTION CODE 15) 

CAUTION 

Command (15) will override both PC memory protect and 

coil disable. 

QUERY 

This message 'orces each coil in a consecutive Dlock of coils to a desired ON or 
OFF state. Any coil that exists within the cc~:-c : ier can be forced to either state 
(CN cr OFF;. However, since the controller s actively scanning, unless the coiis 
are disabled, the controller can also alter the state of the coil. Coils are numbered 
from zero tcoil 00001 = zero, coil 00002 = c~S, etc.). The desired status of each 
coil is packed in the data field, one bit for each coil (1 = ON. = OFF). 

The use of slave address 00 (Broadcast Mocei will force all attached slaves to 
modify the desired coils. 

NOTE 

Functions 5, 6, 15 and 16 are the ciiy messages (othe' than 
Loopback Diagnostic Test) that wi;i be recognized as va.id 
for broadcast. 

The following example forces 10 coils starting at address 20 (13 HEX). The ■ .% : ita 
fields. CD = 1100 and 00 = 0000 0000, indicate that coils 27, 26, 23, 22 a ire 

to be "creed on. 
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ADCP 


^UNC 


H.O. 
ADDR 


LO. 
ADDR 


QUAN 


TITY 


BYTE 
CNT 


DATA 
COIL 
STUS 
20-27 


DATA 
COIL 
STUS 
28-29 


ERROR 
CHECK 
FIELD 




11 


0= 


00 


13 


00 


OA 


02 


CD 


00 


F4 


LRC 



Figure 3-22. Force Multiple Coils Query Message 



RESPONSE 

The normal response will be an ecno of the slave address, function code, starting 
address, and quantity of coils forced. 



ADDR 


FUNC 


H.O. 
ADDR 


LO. 
ADDR 


QUAh 


TITY 




ERROR 
CHECK 
FIELD 




11 


OF 


00 


13 


00 


OA 




C3 


LRC 



Figure 3-23. Force Multiple Coils Response Message 



The writing of coils via Modbus functions 15 will be accomplished regardless of 
whether the addressed coils are disabled or not. 

NOTE 

The Modbus protocol does not include standard functions 
for testing or changing trie DISABLE state of discrete inputs 
or outputs. Where applicable, this may be accomplished via 
device specific program commands. See Function Code 13. 

One additional caution: Coils tha: are unprogrammed in the controller logic 
program are not automatically cleared upon power up. Thus, if such a coil is set 
ON by 'unction Code 15 and (ever months later) an output is connected to that 
coil, the output will be hot. 

3.12 PRESET MULTIPLE REGISTERS (FUNCTION CODE 16) 

QUERY 

CAUTION 

Function (16) will override controller memory protect. 

Holding registers existing within the controller can have their contents changec 
by this message (a maximum of 50 registers). However, since the controller s 
actively scanning, it also can alter the content of any holding register at any time 
The values are provided in binary up to the maximum capacity of the controile r 
(16-bit for the 184/384 and 584); unused high order bits must be set to zero. Whe~ 
used with slave address zero (Broadcast Mode) all slave controllers will load "~e 
specified registers with the contents specified. 

NOTE 

Function Codes 5, 6, 15 and 16 are the only messages (other 
than Loopback Diagnostic Test) that will be recognized as 

valid for broadcast. 
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ADCR 


FUNC 


H.O. 


LO 


QUANTITY 


BYTE 


H.O. 


LO. 


H.O. 


LO 


ERROR 








ADDR 


ADDR 






CNT 


DATA 


DATA 


DATA 


DATA 


CHECK 


























FIELD 




11 


fO 


OC 


87 


00 


02 


04 


00 


OA 


0* 


02 


45 


LRC 



Figure 3-24. Preset Multiple Coils Query Message 



RESPONSE 

The normal response to a function 16 query is to echo the address, function code, 
starting address and number of registers to be icaced. 



ADDR 


FUNC 


H.O. 
ADDR 


LO. 
ADDR 


QUAr* 


TITY 




ERROR 
CHECK 
FIELD 




11 


10 


00 


87 


00 


02 




56 


LRC 



Figure 3-25 Preset Multiple Registers Response Message 



3.13 REPORT SLAVE ID (FUNCTION CODE 17) 

QUERY 

Report Slave ID permits the user to obtain slave type, slave Run light and 
supplementary device dependent status and configuration information. 

Slave ID = for Micro 84 

1 for 484 

2 for 184. 384. 384A. 384B 

3 for 584 
8 for 884 

Runllght = 00 for Run light off 
Runligh: = FF for Run light on 



ADDR 


FUNC 


ERROR 
CHECK 
FIELD 




11 


11 


DE 


LRC 



Figure 3-26. Report Slave ID Query Message 
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RESPONSE 

The general form of the response is as follows: 



SLAVE 
ADDR 


FUNC 


BYTE 
COUNT 


SLAVE 
ID 


RUN 
LIGHT 


DEVICE 
DEPENDENT 


ERROR 
CHECK 
FIELD 












III! 





Figure 3-27. Report Slave ID Response Message 



3.13.1 184/384 SUPPORT OF FUNCTION CODE 17 

An example response for a 184/384 controller with a Run light off is as follows: 



SLAVE 
ADDR 


FUNC 


BYTE 
COUNT 


SLAVE 
ID 


RUN 
LIGHT 


DEVICE 
DEPENDENT 


ERROR 
CHECK 
FIELD 


11 


11 


4A 


02 


00 


llll 





Figure 3-28. Report Slave ID Response Message For 184/384 



The byte count contains the number of data bytes returned to the master. If the 
position of the switches on the J347 matches the actual controller type and the PIB 
table is normal, the byte count will be 4A (HEX). If the switches do not match the 
controller type only 4 bytes of data will be returned. These 4 bytes are: 

1 BYTE Slave ID = 2 for 184/384 

1 BYTE Run light status (0 = off, FF = on) 

2 BYTES Status Word 

BIT C = 

BIT 1 = Status of Memory Protect (0 = off. 1 = on) 

BIT 2 CONTROLLER For 184, BIT 2 = and BIT 3 = 
TYPE For 384, BIT 2 = 1 and BIT 3 = 

BIT 3 

BITS. 4-5 •= unused 

In addition to these 4 bytes of data, if the switches on the J347 match the 
controller type and the PIB table is normal, 70 additional bytes of information will 
be returned. These bytes are transmitted in the following order: 

2 BYTES PIB table starling address 

2 BYTES Controller serial number 
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2 BYTES Executive I.D. 

64 BYTES PiB table (See Table Below) 

NOTE 

If the 184/364 controller is stopped, these 70 bytes cannc; 
be consicered accurate information. The controller snouc 
be running for valid status information. 

PIB TABLE 

WORD 1 • Maximum Number of Output Coils 

2 - Ou:out Coil Enable Table 

3 • Aacress of Input Coil/Run Table 

4 - Number of Input Coils 

5 • Input Coil Enable Table 

6 • Firs* Latch No. (Must be multiple of 16) 

7 - Last Latch No. (Must be multiple of 16) 

8 • Accress of Input Registers 

9 • r,_~i'cer of Input Registers 

10 - S_-ncer of Output & Holding Registers 

11 • Accress of User Logic 

12 - Address of Output Coil RAM Table 

13 - Function Inhibit Mask 

14 - Accress of Extended Function Routine 

15 • Acdress of Data Transfer Routine 

16 • Acdress of Traffic Cop 

17 - Spare 

18 - Function Inhibit Mask 

19 - Acdress of 'A' Mode History Table 

20 • Request Table For DX Printer 

21 - Number of Sequence Groups 

22 - Acdress of Sequence Image Table 

23 - Acdress of Sequence RAM 

24 • Number of 50XX Registers 

25 - Acdress of 50XX Table 

26 - Address of Output Coil RAM Image 

27 • Address of Input RAM Image 

28 - Delayed Output Start Group 

29 • Delayed Output End Group 

30 - Watch Dog Line 

31 - RAM Address of Latches 

32 - Number of Delayed Outputs Groups 

3.13.2 484 SUPPORT OF FUNCTION CODE 17 

An examp.e resporse for a 484 controller with a Run light on is as follows: 



SLAVE 
ADDR 


FUNC 


BYTE 
COUNT 


SLAVE 
ID 


RUN 
LIGHT 


DEVICE 
DEPENDENT 


ERROR 
CHECK 
FIELD 


11 


11 


05 


03 


FF 


llll 





Figure 3-25 Report Slave ID Response Message for 454 
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The five bytes of data for a 484 follow: 

1 BYTE Slave ID = 1 for 484 

1 BYTE Runlight Status (0 = off, FF = on) 

3 BYTES Device Dependent .Refer to the 484 Dataoase. PI-MBUS-302): 

1 byte = System State 

1 byte = First Configuration Byte 

1 byte = Second Configuration Byte 

3.13.3 584 SUPPORT OF FUNCTION CODE 17 

An example response for a 584 controller with a Run light on is as follows: 



SLAVE 
ADDR 


FUNC 


BYTE 
COUNT 


SLAVE 
ID 


RUN 
LIGHT 


DEVICE 
DEPENDENT 


ERPCR 
CHECK 
FIELD 


11 


11 


09 


03 


FF 


m 





Figure 3-30. Report Slave ID Response Message for 584 



The 9 bytes cf data for a 584 are as follows: 



1 BYTE Slave ID = 3 for 584 

1 BYTE Runlight status (0 off, FF = on) 

1 BYTE Number of 4K sections of page memory 

1 BYTE Number of 1K sections of State RAM 

1 BYTE Number of segments in the 584 

2 BYTES Machine State bits (word 65 (HEX) of 584 configuration table) 

— See the 584 Database (PI-MBUS-303) 

2 BYTES Machine Stop Code (word 69 (HEX) of 584 configuration table) 

— See the 584 Database (PI-MBUS-303) 



3.13.4 Micro 84 Support of Function Code 17 

An example response for a Micro 84 controller with a runlight on is as follows: 



SLAVE 
ADDR 


FUNC 


BYTE 
COUNT 


SLAVE 
ID 


RUN 
LIGHT 


DEVICE 
DEPENDENT 


ERROR 
CHECK 
FIELD 


11 


11 


08 


00 


FF 


llll 





Figure 3-37. Report Slave I.D. Response Message for Micro 84 
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The 8 bytes cf data for a Micro 54 are as follows: 

i BYTE Slave ID = for Micro 84 

1 BYTE Runlight Status i0 = off, FF = on) 

1 BYTE Current Port Nc (will De C at present) 

1 BYTE Memory Size of Micro 84 (1 = 1K. 2 = 2K) 

4 BYTES Presently All Zeros 

3.13.5 884 Support of Function Code 17 

An example response for an 884 controller with a runlight on is as folicws. 



SLAVE 
ADDR 


FUNC 


BYTE 
COUNT 


SUWE 
ID 


PUN 
LIGHT 


DEVICE 
DEPENDENT 


ERROR 
CHECK 
FIELD 


11 


11 


08 


08 


FF 


llll 





Figure 3-32. Report Slave I.D. Response Message for 884 
The eight bytes of data for the 884 are as follows: 



1 BYTE Slave I.D. (884 = 08) 

1 BYTE Runlight Status (0 = OFF. FF = ON) 

1 BYTE Current Port No. (1 = port 1 on CPU, 2 = port 2 (optic- 

1 BYTE 884 Application Memory Size (KBytes) 

(User Logic & State RAM) 2 Bytes = 1 Word 

1 BYTE Hook Br.s 

bits 0-7 Reservec 
1 BYTE Hook Bits 

bits 0-2 Reservec 

bit 3 Mapper Bypass — "1" = DO NOT EXECUTE 

STANDARD MAPPER 

bit 4 End of Scan Tests - "1" = TEST END OF 

SCAN HOOKS 

bit 5 Reserved 

bit 6 Logic Sciver Bypass — "1" ■ DO NOT EXECUTE 

STANDARD LOGIC SOLVER 
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bit 7 



1 BYTE 



bits 0-7 



1 BYTE 



bits 0-7 



Reserved 
Hook Bits 
Reserved 
Hook Bits 
Reserved 



2 -4 READ GENERAL REFERENCE (FUNCTION CODE 20) 



QUERY 

Read general reference cuery message requests information contained in Gould 
584L extended memory files. Several sub-requests can be included in one 
message. Each sub-rec-.es: reads a contiguous group of registers. 





[ SUB-REQUEST 






SUB-REQUEST 

i 


ADDR 


FUNC 


BYTE 


REF 


FILE 


REQ 


REG 




REF 


FILE 


REQ 


REG 


ERROR 






CNT 


TYPE 


NO 


ADDR 


CNT 




TYPE 


NO 


ADDR 


CNT 


CHECK 


























FIELD 


B 


B 


B 


B 


W 


W 


W 


» 


B 


W 


W 


W 


W(CRC) 
no 



B(LRC) 



Figure 3-33. Read General Reference Query Message Format. 



SUB-REQUEST 



SUB-REQUEST 



ADDR 



11 



FUNC 



14 



BYTE 
CNT 



0E 



REF 
TYPE 



06 



FILE 
NC 



ooo: 



REQ 
ADDR 



0001 



REG 
CNT 



0005 



REF 
TYPE 



06 



FILE 
NO 



0002 



REQ 
ADDR 



0009 



REG 
CNT 



0005 



ERROR 
CHECK 
FIELD 

CRC 
OR 
LRC 



Figure 3-34. SAMPLE: Read General Reference Query Message. 
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Byte Count = the tota: number of bytes "• trie read general reference message, 
excluding the address, 'unction code, bvte count, and the error check fields: that 
is all ojcurences of tne following: reference tyoe. file number, register address, 
register count. In the read query message illustrated in Figure 3-33 tne byte count 
is 14, !CE in hexadecimal) because two sur>'equests are being sent, each of which 
;s 7 bytes <onc. 

Reference Type = must be 6 (06 hexadecimal). 584L Extended Memory Storage 
Registers. 

File number = the number of the file tc oe read. Extended memory is addressed 
as a group of files, each file containing uc to 10.000 registers. File numDers can 
range from 1 to 10 depending upon the extended memory size added. 

Starting Register Address = the address of the first register to be read. All files 
except the last (highest numbered! have =- address range from tc 9999. The last 
file in tne extended memory increment : retains less than 10.000 registers. The 
following table lists the last adcress ir :ne iast file of a specifiec amount o' 
extended memory 

Table 3-8. Relationship Between Memory Size and Register Addresses 



REGISTER ADDRESSING 

Extended Memory # of Last Last Register Address 

Size File in Last File 



16K 
32K 
64 K 
96K 



2 
4 
7 
10 



6383 
2767 
5535 
8303 



Extended memory is available in increments of 16K or 32K. With 32K of extended 
memory (32.768 accessible registers), tne available register addresses of the four 
files will be: 

File One to 9999 (0000 to 270F hexadecimal) 
File Two to 9999 (0000 to 270F hexadecimal) 
File Three to 9999 (0000 to 270F hexadecimal) 
File Four to 2767 (0000 to 0ACF hexadecimal) 

Register Count = the number of register to be read. The maximum number of 
registers read is dependent upon the maximum message length. The maximum 
query message length is 256 bytes (including check character/s). The maximum 
response message length is the same. I' the starting register address is 5 (0005 
hexadecimal), and the number of registers to be read is 10 (000A hexadecimal), the 
registers read by this function would be registers 5 through 14 (10 registers). 

Error Check = the longitudinal redundancy check if using ASCII transmission or 
the cyclic redundancy check if using RTU ransmission. See paragraphs 1.2.1 and 
1.2.2 for additional information on these ~ethods of error checking. 
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RESPONSE 

One read genera! reference query message can result in one or mce sub- 
resoonses. The addressee slave responds with its own address, the function coce. 
and the total byte count of one or more sub-responses. Eacn sub-response 
contains the byte count of that sub-response, its reference type, and the response 
ca:a. The er'cr check fieid follows the last sub-response. 



SUB-RESPONSE 



ADDR 


FUNC 


BYTE 


SUB 


REF 


1ST 


2ND 






CNT 


RESP 


TYPE 


REG 


REG 








BYTE 




DATA 


DATA 








CNT 


















H L 


H L 


B 


B 


B 


B 


B 


B B 


B B 



! NTH 
' REG 
DATA 

H L 
B B 



SUB-RESPONSi 



SUB 


REF 


1ST 


2ND 


RESP 


TYPE 


REG 


REG 


BYTE 




DATA 


DATA 


CNT 




H L 


H L 


B 


B 


B B 


B B 



NTH 
REG 
DATA 

H L 
B B 



ERROR 
CHECK 
FIELD 



W(CRC) 

OR 
B(LRC) 



Figure 3-35. Read General Reference Response Message Format. 

SUB-RESPONSE 



ADDR 


FUNC 


BYTE 


SUB 


RE- 


1ST 


2ND 


3RD 


4TH 


5TH 






CNT 


RESP 


TYPE 


REG 


REG 


REG 


REG 


REG 








BYTE 




DATA 


DATA 


DATA 


DATA 


DATA 








CNT 




H L 


H L 


H L 


H L 


H L 




14 


18 


OB 




0008 


0002 


0003 


0004 


0005 



I 



SUB-RESPONSE 




SUB 


REF I 1ST 


2ND 


3RD 


4TH 


5TH 


ERROR 


RESP 


TYPE I REG 


REG 


REG 


REG 


REG 


CHECK 


BYTE 


' DATA 


DATA 


DATA 


DATA 


DATA 


FIELD 


CNT 


i 














H L 


H L 


H L 


H L 


H L 


CRC 


0B 


06 l 0002 


0003 


0004 


0005 


0006 




I 










OR 




LRC 



Figure 3-36. SAMPLE: Read General Reference Response Message. 
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Byte Cou"' = the total number of bytes in the reac general reference response 
message, excluding the address, function code, byte count, and the error check 
fieics: :~ai :s a' 1 occurences of tne following: suo-resbcnse byte count, reference 
type. »nc tne first tnrough the nth register in each suc- r esoonse. Therefore in the 
resocrse message m Figure 3-35. the Dyte count o- 24 "5 hexadecimali is the sum 
of me ctes *rcro the resoonse byte count fieic if? tne Srst sub-response tnrough 
tne ?: l t~ register m ;he second sub-response. 

The f,r s: suc-'=S2onse byte count is 11 (OB hexadec mali. and since both sub- 
resocrses hacoen to be the same length, the first and second added togetr,e r 
ec-jai a Dyte count of 22 06 hexadecimal). Therefore the total byte count of the two 
suc-'esccnses including the two response byte counts is 24 (18 hexadecimal). 

Response Byte Count = the number of bytes in eacr separate sub-response. In 
Fig^-e 3-25 the response byte count for the 'irs: sub-resoonse is V 'CB 
"exare; ma;:, as there are 10 bytes of data in tne five 'egisters read and one oyte 
m the -e'erence type or eleven bytes total. 

• 

The resoonse byte count can be different for each suc-response. If. in the second 
sub-resoonse. Figure 3-35, only three registers (2 bytes each) were read, the 
response byte count would then be 7 (07 hexadecimal!. 

Reference Type = must be 6 (06 hexadecimal). 584L Extended memory storage 
register 

1st. 2nc. 3rd ... Register Data = the info:mation contained in each register being 
read. T-;e high order byte is first, and the low oroer byte is second. 

Error C--eck = the longitudinal redundancy check if : jsing ASCII transmission or 
the cyclic redundancy check if using RTU transmission. See paragraphs 1.2.1 and 
1.2.2 for additional information on these methods of error checking. 

NOTE 

Each read of extended memory includes parity er'c r checking of the integrity 
of tne data in memory. Refer to Table 2-1, exception response 08, for additional 
information about parity errors. 



3.15 WRITE GENERAL REFERENCE (FUNCTION CODE 21) 

QUERY 

A write general reference message enters or changes information in Gc^ : 
extenced memory files. 
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SUB-REQUEST 



I 



ADDR 

i 

! 


FUNC 


BYTE 
CNT 


\ REF 

1 TYPE 

j 


FILE 
NO 


REG 
ADDR 


PEG 
CT 


,ST 
REG 
DATA 


1 

: 

i — > — i 


i 

B 

i 


E 


5 


i 
i 

! 3 


W 


W 


W 


W 


i 



NTH : 
REG j 
DATA L 



W 



■SUB-REQUEST- 



REF 


FiLE 


REG 


REG 


1ST 




NTH 


ERROR 


TYPE 


NO 


ADDR 


CT 


REG 




REG 


CHECK 










DATA 


» 


DATA 


FIELD 


B 


W 


W 


W 


W 




W 


W(CRC) 



B(LRC) 



Figure 3-37. Write General Reference Query Message Format. 

SUB-REQUEST 



! ADDR 

i 



11 



FUNC 



15 



BYTE 
CNT 



1C 



REF 
TYPE 



06 



FILE 


REG 


REG 


1ST 


2ND 


3RD 


NO 


ADDR 


CT 


REG 


REG 


REG 








DATA 


DATA 


DATA 


0008 


002D 


0004 


003C 


005E 


0071 



4TH 
REG 
DATA 

0071 



SUB- REQUEST 



1 

' REF 


FiLE 


REG 


REG 


1ST 


2ND 


3RD 


ERROR 


TYPE 


NO 


ADDR 


CT 


REG 


REG 


P EG 


CHECK 


i 








DATA 


DATA 


DATA 


FIELD 


( 

| 06 


0009 


0060 


0003 


0040 


0041 


0042 


CRC 



LRC 



Figure 3-38. SAMPLE: Write General Reference Query Message. 

Byte Count = the total number of bytes in the write general reference message, 
excluding the address, function code, byte count, and the error check fields; that 
is all occurences of the following: reference type, file numoer, register address 
register count, and the first through the last register in the write general reference 
query message. 



in the sample message illustrated in Figure 3-37 the byte count is 28. MC 
hexadecimal) because two sub-requests are being sent, the first being 15 bytes 
length, and the second being 13 bytes in lengih. 
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Reference Type = must be 6 (06 hexadecimal. 584L Extenced rremory storage 
registers 

File Number = ;ne number of the file into whicn information is tr be entered or 
changed. Extenaec memory is addressed as a group of files, eac" 'lie containing 
•jC to 10.000 registers. File numbers range from 1 to 10. 

Starting Register Address = the address of the first register in wrvch information 
is to oe entered z r changed. All files exceDt the last (highest numbered) have an 
address range from to 9999. The iast file in the extendec memory increment 
contains iess than 10.000 registers. Table 3-8 lists the last address in the last file 
of a specified amount of extended memory. 

Register Count = the number of registers in which information will be entered or 
changed. The max mum numDer of registers in which information ;an be changed 
cr entered is cerencent upon the maximum message lerct- The maximum 
response message length is 256 bytes (including check characte- si. 

If tne starting rec iter address is 5 (0005 hexadecimal), and the nu-oer of registers 
into which information will be written is 10 (000A hexadecimal), m'crmation will be 
written into registers 5 through 14 (10 registers). 

1st through last Register = the information entered in each reg-.ster, high order 
byte first, low order byte second. 

Error Check = the longitudinal redundancy check if using ASCIi transmission or 
the cyclic redundancy check if using RTU transmission. See parac-aphs 1.2.1 and 
1.2.2 for additional information on these methods of error checcmg. 



RESPONSE 

The normal resDonse to a write general reference query 
retransmission c* the write request. 

SUB-RESPONSE 



message is the 



ADDR 


FUNC 


BYTE 
CNT 


REF 
TYPE 


FILE 
NO 


REG 
ADDR 


REG 
CT 


1ST 
REG 
DATA 


2ND 1 3 = 3 
REG ! FEG 
DATA | CA~A 


4TH 
REG 
DATA 






1C 


06 


0008 


002D 


0004 


0C3C 


C05E i 0C -< 


0071 



SUE- = ESPONSE 




REF 
TYPE 


FILE 
NO 


REG ! REG 
ADDR j CT 


1ST 
REG 
DATA 


2ND 
REG 
DATA 


3RD 
REG 
DATA 


ERROR 
CHECK 
FIELD 


06 


0009 


0060 j 0003 


00-iO 


0041 


0042 


CRC 




OR 
LRC 



Figure 3-39. SAMPLE: Write General Reference Response Message. 
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DETAILED EXPLANATION OF MCDBUS FUNCTIONS 



SUB-REQUEST 




FUNC I BY'E ! REF j FILE ! REG ! PEG 
CNT | TYPE | NO \ ADDR j CT 



W 



W 



W 



1ST 
REG 
DATA 

W 



I 



NTH 
PEG | 
DATA L 



W 



■SUB-REQUEST 



: REF 


FiLE 


REG 


REG 


1ST 


. TYPE 


NO 


ADDR 


CT 


REG 


i 








DATA 


B 


W 


W 


W 


! 

W j 



NTH 
REG 
DATA 

W 



ERROR 
CHECK 
FIELD 

W(CRC) 

OR 
B(LRC) 



Figure 3-37. Write General Reference Query Message Format. 

SUB-REQUEST 



! ADDR 



11 



FUNC 



15 



BYTE 
CNT 



1C 



REF 
TYPE 



06 



FILE 


REG 


REG 


1ST 


2ND 


3RD 


NO 


ADDR 


CT 


REG 


REG 


REG 








DATA 


DATA 


DATA 


0008 


002D 


0004 


003C 


005E 


0071 



4TH 
REG 
DATA 

0071 







SUB- REQUEST 



REF 


FiLE 


REG 


REG 


1ST 


l 

2ND 


3RD 


ERROR 


TYPE 


NO 


ADDR 


CT 


REG 


REG 


= EG 


CHECK 


j 








DATA 


DATA 


DATA 


FIELD 


j 06 


0009 


0060 


0003 


0040 


0041 


0042 


CRC 



LRC 



Figure 3-38. SAMPLE: Write General Reference Query Message. 

Byte Count = the total number of bytes in the write general reference message, 
excluding the address, function code, byte count, and the error check fields; that 
is all occurences of the following: reference type, file number, register address 
register count, and the first through the last register in the write general reference 
query message. 



in the sample message illustrated in Figure 3-37 the byte count is 28. HC - 
hexadecimal) because two sub-requests are being sent, the first being 15 bytes - 
iength. and the second being 13 bytes in length. 



3-34 



DETAILED EXPLANATION OF MODBUS FUNCTIONS 



Reference Type = must be 6 (06 hexadecimal). 584L Extenced memory storage 
registers 

File Number = tne number ot the file into whicn information is tr be entered or 
changed. Extenaec memory is addressed as a group of files, eac" 'He containing 
■jc to 10.000 registers. File numbers range from 1 to 10. 

Starting Register Address = the address of the first register in wmch information 
is to De entered o r cnanged. All files except the last (hignest numoered) have an 
address range from to 9999. The iast fiie in the extendec memory increment 
contains less than 10.000 registers. Table 3-8 lists the last address in the last file 
of a specified amount of extended memory. 

Register Count = the number of registers in which information will be entered or 
changed. The maximum numoer of registers in which information can be changed 
or entered Is zerencent upon the maximum message lercm The maximum 
response messaze iengtn is 256 bytes (including check charactr- si. 

If the starting rec iter address is 5 (0005 hexadecimal), and the nu-oer of registers 
into which information will be written is 10(000A hexadecimal), information will be 
written into registers 5 through 14 (10 registers). 

1st through last Register = the information entered in each register, high order 
byte first, low order byte second. 

Error Check = the longitudinal redundancy check if using ASCII transmission or 
the cyclic redundancy check if using RTU transmission. See parac'aphs 1.2.1 and 
1.2.2 for additional information on these methods of error checx.mg. 

RESPONSE 

The normal response to a write general reference query message is the 
retransmission c' the write request. 

SUB-RESPONSE 1 



; ADCR 


FUNC 


BYTE 


REF 


FILE 


REG 


REG 


1ST 


2ND 1 3=3 


4TH 


i 




CNT 


TYPE 


NO 


ADDR 


CT 


REG 


REG ! PEG 


REG 
















DATA 


DATA | CA~A 


DATA 


L 




1C 


06 


0008 


002D 


0004 


003C 


005E ! OC"! 


0071 




SUS- = ESPONSE 




REF 
TYPE 


FILE 
NO 


PEG ! REG 
ADDR i CT 


1ST 
REG 
DATA 


2ND 
REG 
DATA 


3RD 
REG 
DATA 


ERROR 
CHECK 
FIELD 


06 


0009 


0060 j 0003 


0040 


0041 


0042 


CRC 




OR 
LRC 



Figure 3-39. SAMPLE: Write General Reference Response Message. 
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APPENDIX A 

MODBUS TRANSACTION TIME CALCULATION 



MODBUS COMMAND RESPONSE CALCULATION 

7ne following is an analysis z i the response times involved to com:;e:e a 
MODEUS transaction: 

*. Master device composes ;rrs message 

2. Query modem at master iRTS/CTSi 

ta) If the RTS and CTS p.r.s are jumpered this time is negligible, 
(b) For the J478, the time is about 5 ms. 
tcj Times vary for othe' Voaems. 

3. Transmission of data tc s = ve PC 

Time imsi = 1000 X (No. of Crars.) X ,'Bits Per Char.) 
(Baud Rate) 

4. Slave processes message 

(a) Since the MODBUS command is processed during a "window" at the e~d 
of the controller scan, the worst rase delay between receiving a message 
and commencing to cocess tha: message is one scan (i.e., the message 
arrives at the slave PC just after the MODBUS "window" closes). Or :~.e 
average, the delay wculd be Vi scan. 

(b) The "window" allotted to the servicing of a MODBUS comma-.: is 
approximately 1.5 ms. wide 'or the 484 and 584. 

In a 184/384, the "wi-'dow" length varies depending on the amcu - : of 
data requested or sent. See Figure A-1. 

Each of the programmable controllers handles its MODBUS por.s - a 
slightly different marmer. 

iM The 484 has its ••window" shared by the J474/J475 and the J473 on 
a contention bas:s. 

121 The 584 has two MODBUS ports, each with its own "window". T-ese 
two ports are serviced sequentially with port 1 being serviced be-ce 

port 2. 

131 The 184/384 has a single MODBUS port. When the 184/384 is .sec 
with a programming panel, the MODBUS port is not operative a-r s 
locked out with a keyswitch. 



MODBUS TRANSACTION TIME CALCULATION 



/4/ The Micro 84 has a single Mocbus port. The Modbus adapter will 
anew simultaneous use of botn the Modbus port arc the P370 
programming pane! port. The messages will oe bu^erec and 
arbitration occurs on a first-come, first-served basis wner both 
ports are active, in the event of a conflict, tne Modbus port will be 
given higner priority. If the Mocbus is ioggec in'*, the ^370 be 
restnetec to monitor-only operations. 

fSl The 884 has 2 Modbus ports, one on the 38<i CPU anc one as an 
option. 

In order to avoid contention only one port may have write privileges 
(consicered as PASSCODE levels 1 through 3) at any given time. 
Possession of the passcode associated with a higher privilege level 
does not imr sly any priority over the ability to modify the contents of 
the PC: ail such abilities are allocated on a first-come. 1 rst-served 
oasis. Nc singie Modbus function or port has a highe- P'-ority tnar 
any other. The ports are serviced in "rouna robin" fas - on. 

NOTE 

However, due to timeout constraints, if a "standard" (i.e.. 
not FC 18) Modbus function cannot be processec 
immediately, it is rejected with a BUSY response, FC IS 
commands are retained within the CPU until they can be 
processed since a POLL mechanism is available. 

(c) Accessing Multiple Points/Registers 

Standard functions 1-4 and 15-16 permit the transfer in a sing e MODBUS 
query of more data can can be exchanged in the time a'.oeated the 
responder between any two connective sv. eeps. Thus, it is sometimes 
necessary for the PC slave interface to buffer blocks c* data and 
distribute their exchange with the slave PC memory over multipie 
consecutive sweeps. 

The amount of data that can be processed during a sing:e MODBUS 
"window" varies according to the type of controller usee. Table A-l 
shows the cuantities allowed. 

. Table A-1. Data Quantities for Single Modbus "Window" 



PC Type 


Discretes 


Registers 


Micro 84 


16 


4 


484 


32 


16 


584 


64 


32 


184/3S4 


800 


100 


884 


• 


'See Note 1 
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MODBUS TRANSACTION TIME CALCULATION 



If a transaction requires more data than these limits allow, the controller will 
continue ! .o handle the maximum amount o' aata possible during each "window" 
until it finishes processing al! of the data. For examoie a .ecuest to read 80 
registers in a 584 would reauire 3 "windows" to finish gathering this data; window 
1 *oulc gatner 32 registers, window 2 wouid gather 32 register, ano winacw 3 
wouic get tne remaining 16 registers. The transmission of the response frame is 
not init:atec until all data is assembled. 

NOTE No. 1 

For both standard Modous Commands and Programming 
Subfunctions in the 884 and Micro 84 affecting references 
(either registers or discretes) ai ; data is read from or to state 
RAM during the space of 1 scan. (The design of the 884 
allows a maximum scan impact of 2 ms per scan for Modbus 
message handling.) However, validation and setup and data 
will require several time slices to be accomplished. For 
t/pical latency times, see Nc:e 2 of the 884. 

NOTE No. 2 

Latency time is defined as : n e time starting when the 
Modbus message is received ty the port until the bit stream 
is transmitted to the Modbus port or state table changed. 
These times vary for each function code. Timing tests for 
typical function codes in the 884 are: 



FC 1 


read 768 coils 


14 scans 


FC 2 


read 256 inputs 


7 scans 


FC 3 


read 125 output registers 


5 scans 


FC 4 


read 125 input registers 


8 scans 


FC 5 • 


force coil 


3 scans 


FC 6 


preset register 


3 scans 


FC 15 


force multiple 768) coils 


18 scans 


FC 16 


preset multiple (100) reg. 


10 scans 



5. S'ave PC performs error check calculation, 
(ai LRC calculation time is less than 1 ms. 

(bi CRC calculation time is 0.3 ms. for each 8 bits of data in the response. 

6. Query modem at slave PC (RTS/CTS-. 

(a) J478 and J474 modems require about 5 ms. 

(b) Times vary for other modems. 

(c) RTS and CTS pins may not be .umpered at this end. 

7. Transmission of response to master. 

Time (ms)= 1000 X (No. of Chars.) X (Bits Per Char.) 

(Baud Rate) 

. 8. Master receives response, verifies error check, strips out data, and passes 
data to the applications program. 
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MODBUS TRANSACTION TIME CALCULATION 



FORCING COILS 
FUNCTION CODE 15 




20 40 80 80 'DO 

NUMBER CF WORDS PER TRANSACTION 

Transaction = 1 word/16 coils/1 reg. 

Figure A- 7. Impact of Modbus Commands on 184/384 Scan Time 
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APPENDIX B 

MAXIMUM QUERY AND RESPONSE DATA PARAMETERS FOR 
184/384, 484, MICRO 84, 884, AND 584 CONTROLLERS 



Table B-1. Maximum Query and Response Data Parameters for 184/384 Controllers 



F'JNC~ ON 


3£SC?:»TICN 


CUER V 


RESPONSE 


* 


READ COIL STATUS 


80C COILS 


300 COILS 


2 


BEAD INPUT STATUS 


30C INPUTS 


800 INPUTS 


3 


READ -OLDING REG. 


100 REGISTERS 


100 REGISTERS 


i 


READ ;NPUT REG. 


100 REGISTERS 


100 REGISTERS 


5 


FORCE COIL 


1 COIL 


1 COIL 


= 


LC AD r EGIS~ER 


1 REGISTER 


1 REGISTER 


7 


READ EXCEPTION STATUS 


N.A 


3 COILS 


3 


LOG" SACK DIAGNOSTIC 


N/A 


N/A 


9 


PROGRAM 184 


NOT SUPPORTED 


NOT SUPPORTED 


10 


POLL !<A 


NOT SUPPORTED 


NOT SUPPORTED 


11 


COMM. EVENT COUNTER 


N/A 


N/A 


12 


COMM. EVENT LOG 


N/A 


70 DATA BYTES 


13 


PROG = AM-GENERAL 


32 DATA BYTES 


32 DATA BYTES 


u 


POLL-GENERAL 


N/A 


32 DATA BYTES 


15 


FORCE MULTIPLE COILS 


800 COILS 


800 COILS 


16 


LOAD MULTIPLE REGS. 


100 REGISTERS 


100 REGISTERS 


17 


REPORT SLAVE I.D. 


N/A 


N/A 


IS 


PROGRAM 


NOT SUPPLIED 


NOT SUPPLIED 


19 


RESE~ COMMUNICATIONS 
LINK 


NOT SUPPLIED 


NOT SUPPLIED 


Table 3-2 Maximum Query and Response Data Parameters for 484 Controllers 

Values are shown for an 8K controller. See the Modbus 484 Programming Protocol 
Refe-ence Guide or the Gould 484 User's Guide fo r maximum sizes of smaller 

controllers. 


FUNCTION 
DODE 


DESCRIPTION 


QUERY 


RESPONSE 


1 
2 


READ COIL STATUS 
READ INPUT STATUS 


512 COILS 
512 INPUTS 


512 COILS 
512 INPUTS 


3 


READ MOLDING REG. 


254 REGISTERS 


254 REGISTERS 
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MAXIMUM QUERY AND RESPONSE DATA PARAMETERS 



Tabie B-2. Maximum Query and Response Data Parameters for 484 Controllers (cont.) 


rUNC i !ON 
CODE 


DESCRIPTION 


QUERY 


RESPONSE 


4 


READ INPUT REG. 


32 REGISTERS 


32 REGISTERS 


5 


FORCE COIL 


1 COIL 


1 COIL 


6 


lOAD REGISTER 


1 REGISTER 


1 REGISTER 


7 


READ EXCEPTION STATUS 


N/A 


8 COILS 


3 


LOOP BACK DIAGNOSTIC 


N/A 


N/A 


9 


PROGRAM 484 


16 DATA BYTES 


16 DATA BYTES 


10 


POLL 484 


N/A 


■ 16 DATA BYTES 


11 


COMM. EVENT COUNTER 


NOT SU^ORTED 


NOT SUPPORTED 


12 


COMM EVENT LOG 


NOT SUPPORTED 


NOT SUPPORTED 


13 


PROGRAM -GENERAL 


NOT SUPPORTED 


NOT SUPPORTED 


14 


POLL-GENERAL 


NOT SUPPORTED 


NOT SUPPORTED 


15 


FORCE MULTIPLE COILS 


800 COILS 


800 COILS 


16 


LOAD MULTIPLE REGS. 


60 REGISTERS 

N/A 


60 REGISTERS 


17 


REPORT SLAVE I.D. 


N/A 


18 


PROGRAM 


NOT SUPPORTED 


NOT SUPPORTED 


19 


RESET COMMUNICATIONS 
LINK 


NOT SUPPORTED 


NOT SUPPORTED 


Table B-2. Maximum Query and Response Data Parameters for 584 Controllers 


FUNCTION 
CODE 


DESCRIPTION 


QUERY 


RESPONSE 


1 


READ COIL STATUS 


• 2000 COILS 


2000 COILS 


2 


READ INPUT STATUS 


2000 INPUTS 


2000 INPUTS 


•3 


READ HOLDING REG. 


125 REGISTERS 


125 REGISTERS 


4 


READ INPUT REG 


125 REGISTERS 


125 REGISTERS 


5 


FORCE COIL 


1 COIL 


1 COIL 


6 


LOAD REGISTER 


1 REGISTER 


1 REGISTER 


7 


READ EXCEPTION STATUS 


N/A 


8 COILS 


8 


LOOP BACK DIAGNOSTIC 


N/A 


N/A 


9 


PROGRAM 484 


NOT SUPPORTED 


NOT SUPPORTED 


10 


POLL 484 


NOT SUPPORTED 


NOT SUPPORTED 


11 


COMM. EVENT COUNTER 


N/A 


N/A 
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MAXIMUM QUERY AND RESPONSE DATA PARAMETERS 



Table B-3. Maximum Query and Response Data Parameters for 584 Controllers cont i 


C L'NCTICN 
CODE 


DESCRIPTION 


QUERY 






COMM EVENT ^CG 


N.'A 


■; DATA BYTli 


1 2 


PROGRAM-GENERAL 


33 DATA BYTES 


33 DATA BYTES 


•t 


POLL-GENERAl 


N.'A 


33 DATA BYTES 


15 


FORCE MULTIPLE COILS 


300 COILS 


500 COILS 


•6 


LOAD MULTIPLE =EGS. 


100 REGISTERS 


•06 REGISTERS 


•7 


REPORT SLAVE i Z. 


N/A 


N A 


13 


P=OGRAM 


NOT SUPPORTED 


NOT SUPPORTED 


* 1 


RESET COMMUNICATIONS 
LINK 


NOT SUPPORTED 


NOT SUPPORTED 


2C 


READ GENERAL. 
RE=ERENCE 




• 


21 


WRITE GENERAL 
REFERENCE 


• • 


• * 




* Refer to Section 3.14 for information. 
** Refer to Section 3.15 for information. 






Table B-4. Maximum Query and Response Data Parameters tz 

Micro 34 Controllers 




FUNCTION 
CODE 


DESCRIPTION 


QUERY 


RESPONSE 


t 


READ COIL STATUS 


64 COILS 


64 COILS 


2 


READ INPUT STA~US 


64 INPUTS 


64 INPUTS 


3 


READ HOLDING 3 EG. 


32 REGISTERS 


32 REGISTERS 


i 


READ INPUT REG 


4 REGISTERS 


4 REGISTERS 


5 


FORCE COIL 


1 COIL 


1 COIL 


5 


LOAD REGISTER 


1 REGISTER 


1 REGISTER 


7 


READ EXCEPTION STATUS 


N/A 


3 COILS 


a 


LOOP BACK DIAGNOSTIC 


N/A 


N/A 


9 


PROGRAM 48-1 


NOT SUPPORTED 


NOT SUPPORTED 


10 


POLL 484 


NOT SUPPORTED 


NOT SUP?C = T Z D 


11 


COMM. EVENT COUNTER 


NOT SUPPORTED 


NOT SUP c :-"ED 


12 


COMM. EVENT LOG 


NOT SUPPORTED 


NOT s~f= :-•=□ 


13 


PROGRAM-GENERAL 


NOT SUPPORTED 


NOTSL = - *£D 
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MAXIMUM QUERY AND RESPONSE DATA PARAMETERS 



Table B-4. Maximum Query and Response Data Parameters for V zro 84 Controllers tcont.) 



FUNCT'ON 
COCS 


DESCRi" ON 


CUER V 


RESPONSE 


M 


POLL-GEN ERAt. 


NOT SUPPORT^- 


NOT SUPPORTED 


15 


-CRCE MULTIPLE COILS 


64 COILS 


54 COILS 


16 


LOAD M'J-TIPLE REGS. 


32 REGISTERS 


32 REGISTERS 




REPCP" SLAVE I.Q, 


N A 


N'A 


ia 


PROGRAM 


» 




19 


RESE~ COMMUNICATIONS 
LINK 


n:a 


N/A 




•The - ;:* ">umbe r of Modbus messa 
£3L"r- i :s Eacr subfunction r.as ai 


ge sen: or received fcv : 
Mere": limi:s. 


"* Micro 84 ca-not exceec tr-.e 




Taoie 3-5. Maximum Query and ResDonse Data Para 


-eters for 884 Controllers 




The vaiues shown are theoretical based on the buffe- sie of the Modbus port of 
the 8S4. The actual values may be limited by the configuration of the individual 884 
(the 854.1 will typically be less). See the 884 (CONFiG-SYS PLAN GUIDE) for 

configuration limitations. 


FUNCTION 
CODE 


DE3C = i? T ION 


QUERY 


RESPONSE 


1 


READ COIL STATUS 


2000 COILS 


2000 COILS 


2 


READ INPUT STATUS 


2000 INPUTS 


2000 INPUTS 


3 


READ -OLDiNG REG. 


125 REGISTERS 


125 REGISTERS 


4 


READ INPUT REG. 


125 REGISTERS 


125 REGISTERS 


c 


POaCE COIL 


1 COIL 


1 COIL 


6 


LOAD REGISTER 


1 REGISTER 


1 REGISTER 


7 


READ EXCEPTION STATUS 


N/A 


8 COILS 


8 


LOOP BACK DIAGNOSTIC 


N/A 


N/A 


9 


PROGRAM 484 


NOT SUPPORTED 


NOT SUPPORTED 


10 


POLL 4S4 


NOT SUPPORTED 


NOT SUPPORTED 


11 


COMM EVENT COUNTER 


NOT SUPPORTED 


NOT SUPPORT : 


12 


COMM. EVENT LOG 


NOT SUPPORTED 


NOT SUPPOF": 


13 


PROGRAM-GENERAL 


NOT SUPPORTED 


NOT SUPPCF" : 
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MAXIMUM QUERY RESPONSE DATA PARAMETERS 



Table 3-5. Maximum Query arc Zesoonse Data Parameters for 884 Controllers :c: . 



FUNC'ION 

code 


DfiSCRiPTiON 


QUER V 


RESPONSE 


•i 


poll-general 


NOT SUPPORTED 


NOT SUP=C=~EC 


-5 


FORCE MULTIPLE COILS 


800 COILS 


800 COILS 


-6 


LOAD MULTIPLE PEGS. 


100 REGISTERS 


100 REGlS" = S 




REPORT SLAVE 1.0. 


N/A 


N/A 


IS 


PROGRAM 


• 


' SEE NC" 


"9 


RESE" COMMUNICATIONS 
LiNK 


N/A 


N/A 



NOTE 

Total number o 1 Modbus messages cannot exceed the 
buffer limit of 25c bytes. Each subfunction has different 
limits. 
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APPENDIX C 
IMPLIED LENGTH SUMMARY 



FUNCTION QUERY IMPLIED LENG - - RESPONSE IMPLIED LENGTH 

CODE LESS ERROR CHECK rtsELD" LESS ERROR CHECK FIELD' 



w' 


Not Cefmec 


Not 


Defined 


1 


6 


3 - 


3rd Byte 


2 


5 


3 T 


3rc Bvte 


3 


5 


3 - 


3rd Byte 


i. 


6 


3 - 


3rd Byte 


5 


6 


6 




5 


6 


6 




7 


2 


3 




8 


6 


6 




9 


2 + 5th Bvte 


2 + 


5th Byte 


10 


2 


2 * 


5th Byte 


i * t 


2 


3 + 


3rd Byte 


'■2 


2 




3rd Byte 


13 


3 -r 3rd Bvte 


3 - 


3rd Bvte 


•i. 


2 


3 * 


3rd Byte 


•5 


7 * 7tn Byte 


5 




16 


7 - 7tn Bv;e 


6 




17 


£ 


3 + 


3rd Byte 


13 


3 + 3rd Byte 


3 + 


3rd Byte 


19 


3 + 3rd Byte 


3 + 


3rd Byte 


20 


2 + 3rd Byte 


2 + 


3rd Byte 


21 


2 + 3rd Byte 


2 + 


3rd Byte 


22-126 


3 -f 3rd Byte 


3 + 


3rd Byte 


127 


2 


2 




128-255 


Not Defined 


3 





•To obtain tota 1 implied frame length, adc 2 :ytes if RTU (for CRC-16) or add 1 byte if ASCII 

{for LRC). See example on next page. 

NOTE 

The number of characters used to transmit the frame differs 

for RTU ana ASCII .'s.^e Section 3). 

=or RTU. number of characters equais number of bytes. 

For ASCII, number of characters equais twice the number of 
bytes plus 3 iCO'on, CR. a" LF). 

IMPLIED LENGTH EXAMPLE: 

In the beio'A' example register 4136 is set to 10 and register 4137 is set to 258. 



ADDR 


RJNC 


HO 
ADDR 


LO 

ADDR 


QUANTITY 


BYTE #7 
CNT 


HO 
DATA 


LO 

DATA 


HO 
DATA 


LO 

DATA 




30 


10 


00 


87 


00 32 


04 


00 


OA 


01 


02 


ERROR 
CHECK 
FIELD 



Figure C-1. Preset Multiple Reg-stsrs Query Message 



LENGTH SUMMARY 



RESPONSE 



ADDF. 


FUNC 


hC 
ADDR 


LC 

ADDP 


QUANTITY 




3C 




10 


00 


37 


00 02 


ERROR 
CHECK 
FIELD 



Figure C-2. Preset Multiple Registers Response Message 



For the query in Figure C-1. the implied length table indicates that the by: 
is 7 t- the 7th byte. The 7th oyte of the query is 04. giving a total length 
4=11 bytes not including the error check bytes f2 for RTU and 1 for ASCI' 
vary depending on the communication mode. 

Fc the r esccr.se in Figure C-2- • - e imciied length tafcie indicates that the i-.: 
is 6 '.not includ:rc the error "eck bytes) Anich agrees with the response ; 



i- 
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